Launch Audit.
A senior engineer reviews your AI-built app before real users and real money touch it. You get prioritized findings and a fixed quote in 3 business days.
$490
3 business daysOne-off · paid upfront
Secure checkout via Stripe · Refund policy
Founding rate $290 · first 5 clients- If the audit doesn't find at least 5 concrete, actionable issues, it's free.
- Fee credited 100% toward a Sprint booked within 14 days.
Scope · 7 areas
What I check.
Illustration: a stack of balanced stones.
- 01
Row-level security and authorization
Can user A read or change user B's data? I check every table policy and every API route, not just the ones the UI calls.
Supabase · RLS - 02
Auth flows
Sign-up, login, password reset, email change, session expiry, OAuth redirects and role checks, in production, not just on localhost.
Sessions · OAuth - 03
Exposed secrets
API keys in the client bundle, in the repo history or in public env files. Service keys that should never leave the server.
Keys · Env - 04
Stripe webhooks and reconciliation
Signature checks, duplicate events, failed payments, refunds and cancellations. Does your database agree with Stripe?
Payments - 05
Deploy and CI
Reproducible builds, separate environments, database migrations and a way to roll back when a deploy goes wrong.
Pipeline - 06
Backups
Are there backups, where do they live, and has anyone ever restored one?
Data - 07
Architecture
Duplicated logic, dead code, the data model, and what will break first as usage grows.
Code
Process · 3 business days
Three days, start to quote.
Day 0
Buy and invite
- Pay upfront
- Read-only invite to repo and backend
- No passwords
Day 1 to 2
Review
- Code and configuration
- Auth, RLS, secrets, payments
- Flows tested by hand
Day 3
Report and quote
- Findings by severity
- The fix for each
- A fixed quote to launch
You get
- Row-level security and authorization
- Auth flows, secrets, Stripe and webhooks
- Deploy, CI, backups and architecture
- Prioritized findings with severity
- A fixed quote for the fixes
Sample report
What the report looks like.
Audit report · demo-app
sample Fictional demo app, used to show the format. Not a client.
Lovable · Supabase · Stripe
Illustration: a beetle, as in a bug found in the code.
- 2 critical
- 1 high
- 1 medium
- 1 low
-
Profiles table readable by anyone
- Before
- RLS disabled on public.profiles. The anon key returns every row, including emails.
- Fix
- Enable RLS. Add select and update policies scoped to auth.uid() = id.
- After
- Anon select returns 0 rows. Users only see their own profile.
-
Webhook accepts unsigned events
- Before
- The webhook handler trusts the request body. A forged event can mark an order as paid.
- Fix
- Verify the Stripe signature. Store event ids and skip duplicates.
- After
- Forged events get a 400. Replays are ignored.
-
Service role key in the client bundle
- Before
- SUPABASE_SERVICE_ROLE_KEY is shipped to the browser through a public env variable.
- Fix
- Rotate the key. Move the admin call into an edge function.
- After
- No secret keys in the bundle. Old key revoked.
-
Password reset links point to localhost
- Before
- The auth redirect URL was never changed from the dev setting.
- Fix
- Set production redirect URLs per environment.
- After
- Reset flow works end to end in production.
-
Backups never restored
- Before
- Daily backups exist, but no one has tried a restore.
- Fix
- Run a restore into a staging project and document the steps.
- After
- Restore tested. Steps in the handover doc.
FAQ
Questions.
Illustration: a statue of a seated man, deep in thought.
01 Do you need my passwords?
No. I never ask for your personal logins. You invite me as a collaborator on GitHub and your backend, with the lowest access that works. For the audit, that is read-only.
I only get write access when we start fixing, and you can remove it at any time.
02 What do you need from me to start?
For the audit: a read-only invite to your code (GitHub) and to your backend (for example your Supabase project), plus a few lines on what the app does and what worries you.
No passwords. Anything else I need, I ask by email.
03 Lovable already scans my app. Why do I need this?
Built-in scanners are a good first pass. They look for known patterns. They do not know your business rules: who should see which rows, what happens when a Stripe webhook arrives twice, or whether a reset link works in production.
I read the code and the configuration by hand and test the flows that matter for your app.
04 Will you rebuild my app?
No, not by default. I fix what you have. If part of it cannot be saved, the audit says so and explains why, with a price, before any work starts.
05 How do payments work?
Audits are paid 100% upfront. Sprints are 50% to start and 50% at launch. Care is billed monthly in advance. MVPs are paid 30% / 40% / 30%.
Payments are processed by my NL billing partner via Stripe, and show on your card statement as WITHPACE.ORG. Invoices are in USD, EUR on request. Refunds follow the refund policy at badii.studio/refunds.
Start
Find out what stands between you and launch.
Buy the audit and get a prioritized list and a fixed quote in 3 business days. Not ready yet? Ask for a free teardown.
Secure checkout via Stripe · Refund policy
Founding rate $290 · first 5 clientsPrefer to talk first? Book 30 min or email badii@badii.studio
Free teardown
48h · max 5 / week