Bolt.new builds and runs your whole app inside a browser tab, gives it a database and puts it live on Bolt hosting before you have finished your coffee. The code it writes is optimized for the demo working in that tab.
I read that code as if it were about to take real customers, which it is. You get a ranked list of what to fix, in plain English, with a fix prompt you can paste straight back into Bolt.
1Line 3: The browser decides the price and who is paying; anyone with the network tab open can check out for fifty cents on another user's account.
Common problems in Bolt.new apps
Not every app has all of these. The report tells you which ones yours has, where, and what to do about each.
Critical
The database secret key in the frontend
When row level security blocks a feature, the quickest fix is to use the secret key (older projects call it the service role key), which bypasses every policy. In a Vite app that key ends up in the bundle, where anyone can take it. I find it, tell you to rotate it, and fix the policy instead.
Critical
Prices decided by the browser
A checkout where the amount, the plan or the user id comes from the request body. Anyone with the network tab open can buy the annual plan for a dollar, or for someone else. I trace every payment path back to the server.
High
Server functions with no idea who is calling
Server functions (Bolt also calls them edge functions) that take a userId from the request and trust it, with no token check. They are public URLs. I list each function, what it can do, and what it needs to verify before doing it.
Medium
Mock data that never left
Early in the build, before Supabase was connected, the app ran on hard-coded arrays. Some screens still do. The dashboard shows demo numbers to real users, and search returns the same five results for everyone.
Medium
One App.tsx that does everything
Routing, state, data fetching and forms in one file that gets rewritten whenever a feature changes. I point out what to split so that a prompt about the settings page cannot break checkout.
Low
Every request assumed to succeed
Fetches with no error handling and no loading state, so a slow or failing Supabase call means a blank screen with no message. Small to fix, and the first thing customers notice.
Treatment plan
How it works
1
Book a check-up
Choose a tier and tell me where to send the report. Add your app's address if it is live. Two minutes, no sales call.
2
Show me your code
Pay by card, then give me read-only access to your code on GitHub (you paste in a key I send you) and let me into your app with test accounts. Never done that? I send you step-by-step instructions for your tool. I measure your app and confirm it fits before I start.
3
Get your diagnosis
Ready to launch, or not yet. Problems ranked, critical ones proven on your live app, each with a prescription for your AI tool. A PDF by email, then 7 to 30 days of questions by email.
4
Fix it, then a free follow-up
Fix the problems yourself, with your AI, or let me do it with the Fix Pack. Tell me within 30 days and I check once more that they are really gone.
No idea how big your app is? That’s normal, and you never have to count anything. Book the review you want; I measure your app before I start and tell you. If it doesn’t fit, you choose: upgrade, narrow it down, or a full refund. “Lines of your code” means the code you and your AI wrote, not the packages and UI kit your tool installed; many apps built with Lovable, Bolt or v0 fit the Safety Scan.
Start small, upgrade later. The Safety Scan’s price counts in full toward a Launch Review or Fix Pack for the same app within 30 days of your report.
Why this price? Software does the first pass, so you pay for the part only a person can do: checking every finding in your code, proving the critical ones and deciding what matters for your app. I take at most 3 Safety Scans and 2 Launch Reviews (or one Fix Pack) a week; if this week is full, yours starts the next.
Prices in US dollars, paid once, no sales call and no surprise invoice: anything extra is your choice, told to you before I start. The clock starts when I can see your code. Reports arrive as a PDF by email, in English, or German if you prefer.
Need a few things fixed after a scan? I fix by the hour at $199, three hours minimum, with the list agreed before I start.
Bigger than 50k lines, or a real mess? Rescue jobs are quoted, from $3,000, no obligation. Email me.
Not for you if
you have a team of engineers who already review each other’s code,
your app’s backend isn’t JavaScript or TypeScript (Python Replit apps, for example), or it is over 100k lines,
you handle regulated data (health records, banking, children), or need a pentest, certificate or compliance sign-off. Taking card payments through Stripe is fine.
A review lowers your risk a lot. It can’t guarantee that your app is secure, and nobody honest will say otherwise.
Bolt.new questions
How do I get my Bolt project to you?
Connect Bolt to GitHub so it commits the project to a repository, or download it and put it in one yourself, then give me read-only access (I send you a key to paste in; it takes a minute). I also need your database schema and policies as SQL, and the names (not values) of the secrets your project uses.
My Supabase tables have row level security. Is that enough?
Only if every table has it enabled and every policy says what you think it says. Policies are often created with the table, then loosened by a later prompt that ran into a permission error. I read every policy and test the ones that matter.
Can I fix things inside Bolt?
Yes. Each finding comes with a fix prompt written for Bolt. For anything that touches Supabase policies or Stripe I also give you the SQL or the server-side change directly, because those are the fixes you want to read before applying.
Why not just ask my AI to review it?
Do, and I will even give you the prompt. You will get a long list. What your AI cannot do is tell you which items are real, prove them against your live app, see your database and hosting settings, or check that its own fixes worked. If you cannot read code, that is the part you cannot do yourself either. It is what you pay me for.
I'm not a developer. Is this for me?
Yes, that is exactly who it is for. If you built an app with AI and cannot tell whether the code is any good, I check it and explain what matters in plain English. You never need to understand the code to act on the report: every problem comes with a prompt you paste into your AI tool. And you do not need to know what to ask. The report answers the questions you would have asked if you knew how.
How do I show you my code?
Most AI builders can push your app to GitHub, a free site that stores code. You give me read-only access by pasting a key I send you into your repository settings, which means I can look but not change anything. Never done it? After you book, I send you step-by-step instructions for your tool. A zip file works too. When the report is delivered, remove my access again; I remind you.
Is my code safe with you?
Every booking comes with an NDA, automatically. I never sell, publish or pass on your code. The only other party that sees it is the AI provider that helps with the first pass, under terms that do not allow it to train on your code. I never need your passwords or your live database, and I delete my copy within 7 days of delivering the final report.
From $149 for the first 10 customers (10 left). Ready within 2 business days. If the Safety Scan finds no problem rated medium or worse, you pay nothing.