Security
Security for apps built with AI
AI tools build fast, but do not always pay attention to who may see what. I find the holes, close them and check your app every day after that.
Where it often goes wrong
These are common holes in apps built with Lovable, Bolt, v0 or Cursor.
Keys in the code
A secret API key that is visible in the browser gives anyone access to your payment, email or AI account.
An open database
Without proper rules, such as Row Level Security in Supabase, anyone with some technical knowledge can read all the data.
Seeing other people’s data
A user who gets to see another customer’s data by changing a number in the link.
Outdated packages
Your app uses dozens of packages made by others. Vulnerabilities are regularly found in them that need an update.
Files open to anyone
Uploads such as invoices or ID documents in storage that is public.
No limit on use
No limit on sign-in attempts or AI requests, so someone can abuse your account or run up your bill.
What I do about it
First: the App Check
I check your app for these holes and rank them by risk, from red to green.
Then: closing them
I close the holes, the most serious first, and test that your app still does what it should afterwards.
After that: every day
A daily check for known vulnerabilities (CVEs) in your packages, with updates, monitoring and backups.
Your data, well protected
- Backups of your database
- Access to your data only for those who need it
- Encrypted connections and securely stored keys
- Monitoring that alerts me when something goes wrong
What I don’t do
I do not carry out formal penetration tests or issue a pentest report or certificate. If you need one, for example for ISO 27001 or a client’s requirement, a specialised firm is the right party. I do not give legal advice on the GDPR either.
Questions about security
Do you do penetration tests?
No. I do not carry out formal penetration tests or issue pentest reports. If you need one for a certification or a client’s requirement, a specialised firm is the right party. With the App Check and maintenance, I make sure your app goes into that well prepared.
What exactly do you do for security?
I check whether secret keys are out of the code, whether your database only shows what a user is allowed to see, for example with Row Level Security in Supabase, and whether sign-in and permissions work properly. Every day I check your app’s packages for known vulnerabilities (CVEs) and update them. And I take care of backups and well-protected access to your data.
Do you help with the GDPR?
On the technical side, yes: I make sure your app protects personal data properly, with restricted access, encrypted connections and backups. I do not give legal advice on the GDPR, such as your privacy statement or data processing agreements.
Know where your app stands within 5 working days
With the App Check you get a clear report on security, database, hosting and backups for €600. If you take a maintenance plan afterwards, I credit the €600 in full.
- Fixed price
- Plain-language report
- Within 5 working days