Recruit Genie
An HR platform with identity checks, role-based access and training schedules, for a UK client.
A security audit for apps built with AI
Before strangers sign up and pay, find out what they could see. We test your app the way someone with bad intentions would, and give you a plain report of what to fix first.
Why AI-built apps need this
AI tools write code that works for the person testing it. Security problems show up when a different person uses it. That person might change an ID in a request, call an API without logging in, or read a key out of the browser. In 2025, one public report found 170+ apps built with a popular AI builder that let anyone read data from their databases. None of those apps looked broken.
Built with Lovable and Supabase? See Lovable and Supabase apps for what we usually find there.
What we test
| Test | In plain words |
|---|---|
| Cross-user access | We log in as user A and try to read and change user B’s data, through the app and directly against the API and database. |
| Database rules | Every table’s access policy (Supabase RLS or your own checks), tested, not just read. |
| Authentication | Sign-up, login, logout, reset, session expiry, social login. Does logout really log you out? |
| Exposed secrets | Keys in the frontend bundle, the repo, and the git history. |
| Server routes | Which endpoints work without login, or with the wrong role. |
| Payments | Webhook signature checks, refund and failure paths, and whether paid access can be granted without paying. |
| File uploads | Who can read uploaded files, and whether file links are guessable. |
| Basics | HTTPS, security headers, rate limits on login and forms, error messages that leak details. |
What you get
- A written report ranked by risk: critical, high, medium, low.
- For each issue: what it is, how we found it, what someone could do with it, and how to fix it.
- A call to walk through the report.
- If you want us to fix it: a fixed price for the Ship It sprint. The audit fee is credited.
How this differs from a scanner
Scanners are good at known patterns, and we use them too. They can't know that a coach should see their own clients and not another coach's. Rules like that are where the serious leaks are, and they need a person to test them.
Price and timing
$490, 3 working days from access. Same audit as the first step of Ship It, so if you also want the app in the stores, we check store readiness at the same time.
Web app only, no app store? The same audit covers it, and we skip the store checks. If you want us to fix what we find, the sprint for a web app covers sign-in, payments, hosting, speed and security instead of store submission, at a fixed price we give you with the report.
Not sure yet? Run through the free 15-point check first. Items 6 to 10 are security checks you can do yourself.
An app where access rules mattered
More case studiesWhat clients say
“We brought iMobile Designs in to improve and refine an existing web application, and they handled everything efficiently. Communication was clear, turnaround was fast, and the final implementation was exactly what we needed.”
Sarah T.Product Manager, SaaS Company
Questions founders ask
Is this a penetration test?
It is a focused security review of your app and its backend by an engineer, with hands-on testing. It is not a formal certified penetration test. If your customers or investors need a certified report, we can tell you what to ask for.
Will you attack my live app?
We test against a staging copy when there is one. If there isn't, we agree the tests with you first and use test accounts only. We never touch real users' data.
What if you find something serious?
We tell you the same day, not at the end of the audit, with the quickest safe fix.
Can you fix what you find?
Yes. That's the Ship It sprint, at a fixed price we give you with the report.
My app is a web app (for example a SaaS). Do I need the App Store part?
No. The same audit covers a web app with no app store involved. For a web app, the sprint covers sign-in, payments, hosting, speed and security instead of store submission. You get a fixed price for it with the audit report.