Security launch check for AI-built apps
Before you hand over the app, find out who else can read its data.
Nimbus Tech tests apps built with Lovable, Bolt, Cursor and Claude Code before they go live. Fixed price, a written report in five working days, and one retest after you fix what we find.
- Price
- From €390
- Turnaround
- 5 working days
- Retest
- One included
- Permission
- Written, always
Any visitor can read the customers table
- Where
- Table
customers. Row-level security is switched off. - Proof
- One request with the public key, sent without logging in, returns every row: names, emails and order totals.
- Fix
- Switch on row-level security and limit each row to its owner.
-- run in the SQL editor
alter table customers enable row level security;
create policy "owner reads own rows"
on customers for select
using (auth.uid() = user_id);
Why
AI builders ship working apps fast. Access rules are where they slip.
of reachable Supabase-backed apps let anyone read database tables without logging in.
Scan of 30,998 live AI-built apps by Reeve, August 2026, as reported by VibeEval.
of 200 audited, publicly deployed AI-built apps had at least one vulnerability.
Deng, Fan and Meng, 2026, arXiv 2606.23130.
The app looks finished and the demo works. The flaw only shows when someone who is not the owner asks for the data, and nobody tries that before launch unless it is their job.
Scope
What gets tested
The launch and full checks are done by hand, with one test account for each user role. Scanners find missing headers. They do not find that customer A can open customer B's invoice.
- Access rules
- Row-level security and storage policies. Who can read, change or delete whose data.
- Accounts and sessions
- Sign-up, login, password reset, session handling and role changes.
- Other people's records
- Changing an ID in a request to reach a record that belongs to someone else.
- Secrets
- Keys and tokens left in browser code, in the repository or in its history.
- Payments and webhooks
- Price changes at checkout and forged payment or webhook calls.
- Files and uploads
- Bucket permissions, accepted file types and public links.
- Dependencies
- Packages with known flaws, and packages the AI tool invented.
- AI features full check
- Prompt injection, data leaking through the model, and misuse of tools the model can call.
Deliverables
What you receive
- A written report. Every finding has a severity, the steps to reproduce it and the fix.
- Fixes in your workflow. Each fix comes as a code change or as a prompt you can paste into your builder tool.
- A one-page summary you can pass to your client.
- One retest within 30 days, to confirm the fixes hold.
- Confidentiality. An NDA on request, before you share anything.
This is what the launch and full checks include. The pre-launch scan gives a written summary instead of a full report, and no retest.
Process
How it works
- You write to us.Send the app's address and a sentence on what it does. You get a reply within two working days.
- We agree the scope in writing.You confirm the price, give written permission and create the test accounts.
- We test.Two working days for the pre-launch scan, five for the launch check, ten for the full check. On a staging copy where you have one.
- You get the report.Questions are answered by email, or on a call if you prefer one.
- You fix, we retest.The report is updated to show what is closed.
Price
Three checks, priced before work starts
Pre-launch scan
€390
excl. VAT
For a prototype, or an app without payments or personal data.
- Automated scan of the whole app
- Manual check of access rules, other people's records, secrets and dependencies
- Written summary in two working days
- No retest
Launch check
€990
excl. VAT
One web app with up to three user roles, before it goes live or is handed over.
- Manual test of access rules, accounts and sessions, other people's records, secrets, payments, uploads and dependencies
- Written report in five working days
- One retest within 30 days
- One-page summary for your client
Full check
from€2,400
excl. VAT, quoted per app
Apps with more roles, several integrations or their own AI features.
- Everything in the launch check
- AI features and integrations tested
- Written report in ten working days
- Two retests within 60 days
Before any work starts
You get the scope and the price in writing. The full check is quoted after a short look at the app.
Agencies
If you hand over several client apps a year, ask for per-app pricing and reports under your own brand.
Ground rules
How we handle your app and its data
- We test only with the owner's written permission.
- Testing stays inside the agreed scope and avoids anything that disrupts real users.
- Data seen during testing stays confidential and is deleted after the retest.
- If we find nothing serious, the report says so.
Who
Who does the work
Nimbus Tech S.R.L. is a small security engineering company. The checks are done by engineers with cybersecurity degrees and years of building backend systems, including products built with AI coding tools.
Every check has one named lead engineer. You deal with that person from the first email to the retest.
Questions
Common questions
Do you need our source code?
Read access to the repository makes the check faster and deeper. Without it, we test the running app from the outside.
Which tools and stacks do you cover?
Apps built with Lovable, Bolt, Replit, v0, Cursor, Claude Code and similar tools, most often on Supabase or Firebase with Stripe for payments.
Will testing affect our live app?
A staging copy is best. On a live app we use our own test accounts and avoid anything that changes other users' data.
Is this a certification?
No. It is a review of the agreed scope at one point in time. It lowers risk. It does not guarantee that no flaws remain.
Contact
Send the app's address. Get a scope and a date back.
A named engineer replies within one working day with the scope, the price and the earliest start. No call needed.
Or write directly: