Snapshot
£49Public appA passive check of the public app with a short report and a prioritised fix list.
- No repository access
- One PDF report
- No subscription
Faults we look for
Vibe-coded app security audits for Lovable, Bolt, Replit, Cursor and Claude Code builds. Reviews can cover Supabase and Firebase security, authentication, permissions, exposed API keys, vulnerable dependencies and deployment settings.
- Exposed API keys
- Public Supabase tables
- Missing row-level security
- Open Firebase rules
- Broken access control
- Weak authentication
- Unsafe CORS
- Vulnerable npm packages
- Missing security headers
- Leaked source maps
- Public admin routes
- Debug endpoints
Choose your review
Pay once. Stripe emails your receipt after payment. We confirm the review scope before testing starts.
Review basisOWASP Top 10:2025
UK guidanceNCSC secure development
ReportingEvidence-led findings
Framework references only. These are not certifications or endorsements.
Recommended launch review
£149Public app + codeA focused live-site and repository review before you launch or take payments.
- Authentication and permissions
- Secrets and dependencies
- One verified recheck
Deep review
£750Complex or sensitive appsA manual review for apps that handle payments, sensitive data or complex access rules.
- Expanded manual scope
- Findings call and fix plan
- One verified recheck
Full penetration test
£999One scoped web applicationA manual web application penetration test with agreed boundaries and written authorisation.
- Application and API attack surface
- Evidence-led vulnerability report
- One verified retest
Review + remediation
From £2,500Find, fix and verifyA scoped security review plus hands-on remediation of agreed priority findings.
- Deep review and fix plan
- Implementation of agreed controls
- Verification and close-out report
Security + performance architecture
From £5,000Threat model, NFRs and test strategyA design-level review of how the system should remain secure, responsive and resilient as real traffic and failure arrive.
- Threat model and trust boundaries
- Performance and resilience requirements
- Load, stress and soak test design
ISO/IEC 27001:2022 readiness
From £7,999ISMS implementation and audit preparationBuild a proportionate information security management system and prepare its people, controls and evidence for an independent certification audit.
- Gap assessment, scope and risk method
- Statement of Applicability and evidence
- Internal audit and management review readiness
Add after your review
Buy only when you need more help.
Upgrade to Launch ReviewFor existing Snapshot customers£100Buy upgrade
Verified recheckConfirm your priority fixes£39Buy recheck
Fix review call45 minutes with your report£79Book call
From signal to a useful report
Found
High
Database rules allow public readssupabase/migrations/003_profiles.sql
Open
Explained
Finding 02High severity
Anyone can read customer profiles
The public API has no row-level security policy.
Evidence
alter table profiles enable row level security;Enable row-level security, then add a policy that compares the signed-in user ID with the row owner.
Verified
Pass
Customer profiles are privatePriority fix rechecked
Closed
Share the build
Send the live URL and optional read-only code access.
Check the risks
We review access, secrets, dependencies and deployment.
Fix in order
Every finding includes evidence and a practical action.
Harden the weak points
A scan finds the fault. A review explains the control that should replace it. A recheck confirms the fix.
- Lock database rows with access policies
- Move secrets out of the browser
- Tighten authentication and session rules
- Patch vulnerable dependencies
- Add security headers and rate limits
ExposedPublic database readsHigh risk
RestrictedRow-level policy addedReady to test
VerifiedUnauthorised reads blockedPassed
Good questions
What do you actually check?
We look for exposed secrets, weak access controls, unsafe database rules, vulnerable dependencies, misconfigured authentication and common deployment mistakes. Your scope is agreed first.
Can you review Lovable, Bolt or Replit apps?
Yes. We review AI-generated code and vibe-coded apps built with Cursor and Claude Code too, including common Supabase row-level security and Firebase security rules. The build tool does not change the need for authorisation and a clear test scope.
Is this a penetration test?
No. The launch review is a practical security review for an early product. It is not a certified penetration test and should not be described as one.
What does the £999 penetration test cover?
It covers one agreed small web application and its in-scope API surface. Written authorisation, targets, test accounts, exclusions and timing are agreed before testing. Denial-of-service, social engineering, physical access and unauthorised third-party systems are excluded by default.
Do you need my source code?
Not for a snapshot. Repository access makes a launch review much more useful because it lets us find issues a public URL cannot reveal.
What happens to my code?
Access is read-only and limited to the review. The final handling and deletion policy is written into the scope before you share anything.
Can you scan any website?
No. We only review systems you own or are explicitly authorised to test. Active testing is never started without written permission.
Will you fix the issues too?
The report gives clear fixes. Hands-on remediation can be scoped separately when you want implementation help.
What happens after I pay?
Stripe sends your receipt to the email used at checkout. We then confirm the app URL, authorisation and review scope before any testing starts.
Does your ISO/IEC 27001 service include certification?
No. We provide ISMS implementation and audit-readiness support. Certification is an independent decision made by a certification body, and its audit fees are separate.
Ask before you buy.
Send the app URL and the review you are considering. We will reply by email.