Security & Risk Register
A ranked list of the risks worth acting on first.
+Risk: public storage bucket exposes uploads
+Severity: high
+Fix: restrict reads and add signed URLs
AI App Safety & Readiness Audit
Is your AI-built app
safe to ship?
You built something real with AI. I check what the AI did not: exposed secrets, broken access control, privacy gaps, dependency risk, and the missing docs another developer would need.
Engineer and compliance consultant. I help founders see what is exposed, fragile, valuable, and worth fixing next.
+ Founding-client audit: €600
+ First 5 clients in exchange for a short testimonial
+ If no meaningful, fixable issues surface, you do not pay
AI tools ship fast. Risk hides in the quiet parts.
These problems are normal, fixable, and better found by a calm engineer now than by a user, customer, investor, or acquirer later.
+Secrets or API keys exposed in the client bundle or committed to the repo
+Missing or broken authentication and access control
+Database rules left open to public read/write
+Personal data handled without privacy or compliance basics
+Users are not clearly told when they are interacting with AI
+Unpatched, abandoned, or unclear dependencies
+No documentation, so no one can safely take it further
What you get
A fixed-scope, time-boxed review of your app's security, compliance exposure, structure, and handoff readiness.
+Security and secrets review
+Authentication and access-control review
+Data-handling and privacy review
+Dependency and vulnerability check
+Architecture summary and risk map
+Product clarification and prioritized roadmap
+Handoff documentation for a future developer
+Optional investor or customer-facing technical summary
What changes after
01
Know what to fix before you launch or demo.
02
Hire a developer without paying them to rediscover the project.
03
Understand your real security and compliance exposure.
04
Explain the product with a credible technical story.
05
Stop guessing which issue matters first.
The deliverables look like real working artifacts
Not vague strategy. You get documents a founder, developer, investor, or customer can actually read and use.
Technical Audit
A plain-English review of the current app, stack, and weak points.
+Auth: login exists, authorization checks are incomplete
+Data: PII collected without retention rules
+Dependencies: 4 packages need review
Codebase Handoff Guide
The document another developer needs before touching the repo.
+Runbook: local setup and env vars
+Architecture: frontend, backend, database, services
+Known hazards: fragile areas to avoid changing blind
Roadmap / Next Steps
A practical order of operations for fixing, pitching, or launching.
+Week 1: lock down secrets and access rules
+Week 2: document data flows
+Later: refactor payment and onboarding edges
How it works
01
Book the teardown
A free 15-minute call to confirm the app, risk profile, and whether the audit is worth doing.
02
Share the repo and app
You send the codebase, live URL, and any context that explains what the product should do.
03
Audit sprint
I review security, compliance exposure, architecture, dependencies, and handoff gaps.
04
Review call and docs
You get the final documents, risk map, and a next-step plan you can act on.
Best for
- +You built an app or prototype with AI tools
- +You have a working repo, demo, or deployed app
- +You want to hire, raise, launch, pitch, or clean up the project
- +You need a technical second opinion before more money goes in
Not the right fit if
- -You do not have a working app or repo yet
- -You want a rubber stamp instead of an honest review
- -You need a full rebuild immediately
- -You are shopping for the cheapest ongoing development
Founding-client pricing
€600 fixed-scope audit
The first 5 clients get the full AI App Safety & Readiness Audit at €600 in exchange for a short testimonial if the work is useful. Free teardown first. If the audit does not surface meaningful, fixable issues worth acting on, you do not pay.
FAQ
Do I need to be technical?+
No. The audit is designed to translate technical risk into plain language, practical priorities, and documents you can share with a developer, investor, or customer.
What if my codebase is messy?+
That is normal for fast AI-assisted builds. The point is to identify what is fragile, what is fixable, and what needs to be documented before the project goes further.
Do you rewrite the app?+
Not in this fixed-scope audit. You get the review, risk map, handoff docs, and next-step plan. If implementation support makes sense afterward, we can scope that separately.
What tools and stacks do you review?+
Cursor, Lovable, Replit, Bolt, v0, Claude, ChatGPT-assisted builds, and conventional web app stacks. The audit is focused on the product, repo, data flow, and deployment risk rather than one specific tool.
Is this confidential?+
Yes. Your repo, product details, and documents are treated as confidential. I can also work under your NDA if needed.
How long does it take?+
The audit is designed to fit into a short, fixed-scope sprint after the teardown call and access handoff.
Final step
Want a calm second opinion before you ship?
Book the free teardown and we will decide whether the €600 audit is the right next move. If you are not ready for that, grab the checklist and run the first pass yourself.