Finding 1, high severity
Identity spoofing
A client could change their own name, email and company through the API. The admin would then see a forged identity and could send work or invoices to the wrong person.
Your AI-built app works. Is it safe to launch?
Lovable's scanner said “no issues”. Our audit found 2 high-severity flaws in the same app.
For apps built with Lovable, Bolt, Cursor or v0, usually on Supabase.
Test app we built and audited ourselves
Case study: Studio Desk
Studio Desk is a small client portal (projects, invoices, file uploads) built in Lovable on TanStack Start, React 19 and Supabase. About 1.2k lines of code.
- Platform scanner
- 0 issues
- Our review
- 11 findings: 2 high, 4 medium, 5 low
- Health score
- 7/10
The two high-severity findings, in plain language
Finding 2, high severity
“First signup becomes admin”
On a fresh database, or after the admin account is deleted, the next stranger to sign up becomes admin. Two simultaneous signups could both get admin.
All 11 findings
Highlighted: fix these first.
| No. | Severity | Finding |
|---|---|---|
| 1 | High | High Clients can change their own name/email/company via the API → admin sees forged identity and may assign work or invoices to the wrong person. |
| 2 | High | High “First signup = admin”: on a fresh DB or after admin deletion, the next signup becomes admin; no lock against simultaneous signups. |
| 3 | Medium | Medium Open self-signup: anyone can create a client account and appear in admin pickers. No invite-only flow. |
| 4 | Medium | Medium Upload rules (file type, 25 MB limit) only checked in the browser, not on the server. |
| 5 | Medium | Medium Not portable off Lovable: dependencies pinned to a private registry, storage bucket not in migrations, empty schema file. |
| 6 | Medium | Medium Silent failures: network errors show as “no data” or “Project not found”. |
| 7 | Low | Low No database indexes on key columns; no pagination (pages load every record). |
| 8 | Low | Low Comments can't be edited/deleted; no file delete; orphaned files if a save fails after upload. |
| 9 | Low | Low Totals mix currencies; admin can select themselves as a client. |
| 10 | Low | Low 2 high-severity vulnerable dependencies (js-yaml, nanoid); fixable with an update. |
| 11 | Low | Low 465 lint errors (mostly formatting); only 1 test. |
Fresh apps are decent. The real risks are in business logic, portability and error handling, and they grow with every prompt.
Six areas where AI-built apps break
Platform scanners look for known patterns. We read your app the way an attacker, a confused user, or the next developer would.
Each area links to what it caught in Studio Desk.
Access rules
Who can read and change what (Supabase RLS, policies).
Finding #1
Auth & roles
Signup, admin rights, account takeover paths.
Uploads & storage
File type/size limits enforced on the server, bucket permissions.
Portability
Can your app run and deploy outside the AI builder?
Finding #5
Reliability
Error handling, empty states, data that fails silently.
Dependencies & code health
Known vulnerabilities, tests, maintainability.
Three steps, no passwords
1
Send your app.
Fill in the form; share the URL and (optionally) a read-only repo invite.
2
Get your report.
Prioritized findings in plain language within ___ days.
3
Fix it.
Do it yourself with the report, or we fix it for you.
Start free. Pay only for what you need.
Fixed price agreed before any work starts.
Mini-audit
Top 3 risks, short written summary.
Free
Full audit
Full report like the Studio Desk sample, prioritized fix list, 30-min call.
from€___
Audit + fixes
We fix the high and medium issues and re-check.
from€___
Get a free mini-audit
Every audit starts with the free one.
A real person reads your code
Hunor
Software developer and tester.
Studying computer engineering at BME (Budapest University of Technology and Economics).
Based in the EU.
How we handle your app
- Read-only access is enough. No production passwords needed.
- We never change your live app without written approval.
- NDA on request.
- Access removed and your data deleted after the audit.
- EU-based, GDPR-compliant handling.
Questions founders ask
Do you need my password?
No. A read-only repo invite or app URL is enough to start.
Will you break my app?
No. We review; we don't touch production without approval.
I'm not technical. Will I understand the report?
Yes. Every finding explains the business risk in plain language, plus how to fix it.
Which platforms do you cover?
Lovable, Bolt, Cursor, v0, and apps on Supabase / React / Next.js-type stacks.
How long does it take?
Mini-audit: ___ days. Full audit: ___ days.
What does it cost?
See pricing above; the price is fixed and agreed upfront.
Get your free mini-audit.
Tell me about your app. I'll reply within 48 hours with next steps.
- Top 3 risks in your app, in plain language.
- No passwords. Read-only access is enough.
- No obligation to buy anything.
Prefer email? Write to hunor@nodereel.com.
Thanks! You'll hear from me within 48 hours at hunor@nodereel.com.