Launch Audit · for apps built with AI

Your app works in the demo. Is it safe to launch?

You built it with Lovable, Bolt, Cursor or Claude Code. Before real users, real money and real data arrive, I find what breaks and tell you exactly what to fix first.

See packages From $900 · report in 3 days
CRITICALC-1 · Database
Where
supabase/migrations/0004_invoices.sql:12
What
Row Level Security is off on invoices. Any signed-in user can read every customer's invoices.
Check
Sign in as a second test user and list invoices. You see all of them.
Fix
Enable RLS and add a policy limiting rows to their owner.
Effort
2 hours · Verified

Illustrative example of the report format. This is one of the most common issues in AI-built Supabase apps.

What I check

Twelve areas where AI-built apps usually break

Data access

Database rules, who can read whose records, admin keys leaking to the browser.

Login and roles

Server-side checks on every route, password reset, invitations, account takeover.

Payments

Webhook verification, retries, refunds, access granted from real payment state.

AI cost and safety

Spend caps per user, prompt injection, unsafe rendering of model output.

Secrets

Keys in code, git history, public env vars and preview deploys.

Rebuildability

Can the database and app be rebuilt from the repo alone if something goes wrong?

Deploys

Staging that touches production, missing CI, outdated dependencies.

Email delivery

SPF, DKIM, DMARC, so signup and password emails don't land in spam.

Monitoring

Error tracking, logs without passwords or tokens, uptime alerts.

Performance

Page weight and load time on a normal phone, slow queries.

Privacy

What you collect versus what your policy says. Health or finance data flagged.

Handover

Could a new developer, or an AI agent, safely change it next month?

Packages

Fixed prices, paid upfront, no surprises

Launch Check

$900
3 business days
  • Your top 10 risks, ranked
  • Evidence and the fix for each
  • 30-minute call

Full Launch Audit

$2,400
5–7 business days
  • All twelve areas
  • Plain-language verdict for founders and investors
  • Every finding with file and line, a check you can run, and an hour estimate
  • Prioritised fix plan
  • 60-minute walkthrough, 14 days of follow-up questions

Fix Sprint

from $6,000
2–4 weeks
  • I fix the Critical and High findings in your repo, with tests
  • Quoted from the audit, finding by finding
  • Half the audit fee credited if booked within 30 days

Need ongoing help after launch? Monthly code and AI-PR reviews from $3,000/month.

How it works

From first message to fix plan in a week

  1. Fit call, 20 minutes. A short questionnaire, then a call. I tell you honestly if you need an audit.
  2. Read-only access. Repo, database dashboard, hosting, payments in test mode. I never touch production.
  3. Audit. An AI-assisted sweep, then every finding reproduced by hand. Unverified hunches stay out.
  4. Report and walkthrough. We go through the risks live, in order, with what each fix costs.
Who you're working with

A senior engineer who builds with AI every day

I'm Vadim Lysenko, a lead fullstack engineer with 7+ years of production work in US healthcare, fintech, trading and adtech. I build my own tooling for AI coding agents, so I know where generated code cuts corners.

  • Sole engineer on a US healthcare AI product: desktop, web and browser extension, 50+ releases in 11 months.
  • Found and fixed a high-severity patient-data exposure in that product.
  • Cut a fintech app's load size by 57% and its known dependency vulnerabilities from 78 to 2.
  • Author of bearing, review and governance tooling for AI coding agents.
  • Contributor to GitNexus, a code knowledge graph for AI assistants with 48,000 GitHub stars.
Questions
Is this a penetration test?

No. It's a code, configuration and architecture review aimed at launch risks. If you need a pentest certificate for compliance, I'll tell you and recommend a specialist.

I'm not technical. Will I understand the report?

Yes. Every finding has a plain-language impact line and a check you can follow yourself. The verdict on page one is written for founders and investors.

Will you rewrite my app?

Usually no. Most AI-built apps need targeted fixes, not a rewrite. The report also lists what looks good, so you know what to keep.

What about confidentiality?

I sign an NDA on request, work with read-only access, and delete your code from my machines 30 days after delivery. Nothing is published without your written permission.

How do I pay?

By invoice in USD, upfront for audits. Fix Sprints are 50% upfront and 50% on delivery.

Book a 20-minute fit call

Tell me what you built and when you launch.

Email me a link to your app and your launch date. I reply within one business day.

vadim.lysenko.ua@icloud.com