Security & UX checks for apps built with Lovable, Replit, Claude Code & friends

Is your AI‑built app safe to launch?

I check it like a home inspection — every room, in plain English. Is it safe? Is it easy to use? Before customers trust it with their data and their money, you’ll know exactly what to fix first.

Book a Go-Live Check — $290 See a sample report
  • Security + UX
  • Fixed price
  • Report in 3 business days
  • No calls needed
1 2 3 4 5 6 keys under the mat!
  1. 1Secret keys
  2. 2Admin pages
  3. 3Customer data
  4. 4Payments
  5. 5Backups
  6. 6Error alerts

What I check

Six things that decide whether your app is ready — plus how it feels to use.

Each one is a real problem in apps built with Lovable, Bolt, Replit or Claude Code — usually running on Supabase or Firebase — explained in words that don’t need a developer to translate. Then I use your app the way your customers do, and note what gets in their way.

1

Secret keys left in your app

“keys under the doormat”

API keys sitting in your app’s code, where anyone can copy them.

Means: surprise bills, or a stranger in your data.

2

Admin pages anyone can open

“the back door is unlocked”

Admin pages that open without logging in.

Means: anyone can change your prices, bookings or users.

3

Customer data strangers can read

“files out the window”

One customer can see another customer’s details — or a stranger can see everyone’s.

Means: a data leak, and the trust that goes with it.

4

Payments that aren’t verified

“nobody checked the safe”

Payments that look fine but aren’t verified, and refunds nobody tested.

Means: customers marked “paid” who never paid.

5

Backups nobody has tested

“boxes in the basement”

Backups that exist, but have never been restored even once.

Means: one bad click and the data is gone for good.

6

Errors nobody hears about

“smoke alarm, no batteries”

Errors happen silently, and you only hear about them from customers.

Means: problems that grow for weeks before anyone notices.

Plus: a UX review. A secure app can still frustrate people. I also flag what confuses, annoys or turns away your customers — like a password you can’t see as you type, or having to sign up before you can book.

See the full checklist →

The report

What you get, in plain English.

Every finding says what’s wrong, why it matters to your business, and how urgent it is. Plus a 10-minute video walking you through it, and a ready-to-paste fix prompt for Lovable or Cursor.

These are real findings from a test app I had Lovable build. No real customer data.

Real findings · A cleaning company’s booking app we built with Lovable to test

Go-Live Report

Inspected by Umut
0Fix now
1Fix soon
2Minor
8Looks good
  • Fix soon
    Your app decides who is a staff cleaner by an email address that users can edit.

    A sturdier design ties roles to a permanent account id, not an email. No customer can abuse this on its own — but if a cleaner’s email is claimed before they sign up, the wrong account can inherit their access. Low risk today, worth fixing: match cleaners by account id. This only appeared after the cleaner feature was added.

  • Minor
    One account could flood your calendar with fake bookings.

    There’s no limit on how many bookings a customer can make.

  • UX
    Nobody can book without creating an account first.

    Many visitors give up at this point. Let them book first, and create the account at the end.

  • Looks good
    Customers only ever see their own bookings and photos.
  • Looks good
    Home photos are in private storage, not at public links.
  • Looks good
    Nobody can make themselves the owner.
Inspector’s note: the first version was solid, and the backend is well-locked. The one thing to harden appeared when a new feature was added. That’s why one check isn’t enough.What’s in a full report

How it works

Three steps. No calls.

1
Day 0

Invite me

Add me as a collaborator to your project. No passwords, and you can remove me anytime.

2
Days 1–3

I inspect every room

I test your app the way a curious stranger would, then check the code behind it.

3
Day 3

You get the answer

A plain-English report and a short video. Fix it yourself, or let me do it.

Pricing

One fixed price. No hourly surprises.

Go-Live Check

$290
Report in 3 business days
  • All six checks
  • Plus: a UX review
  • Plain-English report, ranked by urgency
  • Fix prompts to paste into Lovable or Cursor
  • 10-minute video walkthrough
  • One app, up to ~20 screens
Start a check
Recommended

Check + Fix

from $990
Fixed quote after the check
  • Everything in the Go-Live Check
  • I fix every critical and serious issue
  • Re-tested, with before/after proof
  • Backups and error alerts set up
Check and fix my app

Care Plan

$290 / month
Cancel anytime
  • Re-check after big new features
  • Monthly security check
  • Updates and backup tests
  • Up to 2 hours of small changes
  • Reply within 48 hours
Keep my app healthy

Your $290 counts toward a fix.Upgrade to Check + Fix within 14 days and the check is credited in full.

Nothing serious? You don’t pay.If I can’t find a single serious issue, the check is free.

To order, email me your app: umutcakirbm@gmail.com · Reply within 1 business day

Umut ÇakırUmut, your inspector

Who you’d be working with

You talk to the person doing the work.

I’ve been building for the web since 2013. First three years as a freelancer, designing and building websites for clients. Then ten years as a software engineer. For the last four, I’ve worked on the desktop app of an end-to-end encrypted messaging product — the kind where a small security mistake is never small.

I use AI tools every day, so I know where they shine and where they quietly cut corners. No sales team, no juniors. Just me, and a careful look at your app.

Umut ÇakırSoftware engineer · Istanbul

Questions

Fair questions.

Do I need to give you my passwords?

No. You invite me as a collaborator (for example in Lovable, GitHub or Supabase), and remove me the moment we’re done.

I’m not technical. Will I understand the report?

That’s the point of it. Every issue says what’s wrong, why it matters to your business, and how urgent it is — in plain words.

Which tools do you work with?

Apps built with Lovable, Bolt, Replit, Claude Code or Cursor, running on Supabase or Firebase. For Bubble and Base44 I can inspect and report; fixes are limited.

Is my Lovable (or Bolt, Replit) app secure by default?

Sometimes the first version is fine. The most common problem is that the database’s access rules (Supabase “RLS”) are missing or too open, so one customer — or a stranger — can read other people’s data. And every new feature can change who sees what: in my own test app the first version was solid and the backend stayed well-locked, but the cleaner feature identified staff by an editable email — a thing worth hardening that an automated scan didn’t flag.

Lovable already scans my app. Why pay you?

Run Lovable’s scan and its automated pentest — they’re a good first step, and they catch known attack patterns. I look for what they miss: design choices a scanner can’t judge (in my own test app the scan passed, but a feature identified staff by an editable email — worth hardening), whether the app is easy to use, and what to fix first, in plain English. And if you want, I fix it.

My app passed a check. Why would I need the Care Plan?

Because your app keeps changing. Each new feature mixes with the old rules in new ways, and that’s where holes appear. The Care Plan re-checks your app every month and after big new features, so a safe app stays safe.

What if you don’t find anything?

Then you know your app is in good shape — and you don’t pay.

Check the locks
before you open
the doors.

Fixed price, plain English, three business days.

Book a Go-Live Check — $290