40.6%
of 2,144 AI-built Supabase repos scanned had a critical exposure. Lovable apps: 57.9%. Non-AI apps: 24.9%.
For apps built with Lovable, Bolt, Replit or Cursor
We fix the security holes in AI‑built apps, then deploy them.
Supabase RLS, exposed keys, storage policies, env vars and auth redirects. Fixed price from $149. 48‑hour turnaround. Full‑refund guarantee.
| Check | Before | After |
|---|---|---|
| RLS | Off on 2 tables, readable with the anon key | Enabled on every table, tested with the anon key |
| Keys | service_role key in client JS | Removed from the bundle, rotation guidance given |
| Storage | Public bucket allows listing | Listing and upload policies set |
| Auth | Redirects point at preview | Site URL and redirect allow-list match production |
Illustrative example, not a real customer's app.
Why it matters
Published scans found exposed data in AI‑built apps.
173
of 1,072 vibe-coded apps scanned had a critical vulnerability. 39 had tables fully readable by anyone with the public Supabase key.
9.3
CVSS score of CVE-2025-48757, a Lovable Row Level Security (RLS) issue (disputed by the vendor).
Source: NVD — CVE-2025-48757
How it works
Agents check. A human engineer approves every change.
Fixes are drafted as a pull request with SQL migrations. A human engineer reviews and approves every change before it reaches production.
- 01
Intake
Tell us your stack, repo, deploy target and domain. Consent to the scan and changes.
- 02
Access
Invite us to GitHub, Supabase and your host. The 48-hour clock starts when access is confirmed.
- 03
Check and fix
Agents run the checks and draft fixes. A human engineer reviews and approves every change.
- 04
Ship and hand off
Backup, migrate, deploy, re-check. You get a before/after table and a written report of every issue found and fixed.
What we check
- RLS
- Enabled on every table, tested with the anon key
- Storage
- Public vs private buckets, listing and upload policies
- Keys
- Client bundle and repo history scanned for secrets
- Env vars
- Code vs host, client-exposed secrets flagged
- Auth
- Site URL and redirect allow-list match production
- Deploy
- Build, domain and SSL, smoke test of core flows
Access and safety
Least-privilege access. You revoke it at handoff.
What we ask for
- GitHub
- Collaborator access on the repo
- Supabase
- Project member access, never your password
- Hosting
- An invite to your hosting team
How we handle it
- No credentials by email. Use invites or a password-manager share.
- Database backup before every migration. Staging branch first. A rollback plan.
- Real user data and payments are handled by a human, not an agent.
- At handoff we ask you to revoke our access. We keep no copies of secrets.
- We never scan or publicly name an app without the owner's permission.
Pricing
Fixed price. 48‑hour turnaround.
One price per app. No hourly billing. After checkout you're sent to the intake form.
Security Fix
$149
One-time · 48h turnaround
- RLS audit and fixes on all tables
- Storage bucket policies
- Secret / key scan of the client bundle
- Key rotation guidance
- Short plain-English report
Fix & Deploy
$249
One-time · 48h turnaround
- Everything in Security Fix
- Production deploy (Vercel, Netlify, or Lovable/Replit hosting)
- Env vars set up on the host
- Supabase auth / redirect URLs
- Custom domain + SSL
- Smoke test of key flows
Launch Pack · add-on
$149 one-time
or $99/mo for ongoing launches
- Product Hunt + Reddit launch posts
- SEO title, meta & landing copy
- Curated directory submission list
- Monthly: new posts and a refreshed list
Refund guarantee
If we don't fix the critical issues and get your app live within 48 hours of receiving working access, you get a full refund.
Included
- One app, one Supabase project, one deploy target per order
- Production deployment in the $249 Fix & Deploy plan only
Not included
- New features
- Custom backends and VPS/Docker setups (quoted separately)
- Penetration testing, security guarantees or compliance certification
Free mini check
Find out if your app is exposed.
Send your app's URL. We run an automated, read-only check of anon-key access and your client bundle. Within 24 hours you get a one-page summary.
Request my free checkWhat the summary shows
- Red
- Data readable with the anon key, or secrets in your bundle
- Yellow
- Loose policies or config worth a look
- Green
- Nothing critical found
A quick read-only scan, not a full audit.
What do you need access to?
Least-privilege access only: GitHub collaborator access on the repo, Supabase project member access (never your password) and an invite to your hosting team. At handoff we ask you to revoke our access, and we keep no copies of secrets.
What if you can't fix it?
If we don't fix the critical issues and get your app live within 48 hours of receiving working access, you get a full refund. The 48-hour clock starts when access is confirmed.
Which platforms do you support?
Apps built with Lovable, Bolt, Replit or Cursor that use Supabase, deployed to Vercel, Netlify, or Lovable/Replit hosting. Each order covers one app, one Supabase project and one deploy target. Custom backends and VPS/Docker setups are quoted separately.
Is my data safe? Will you break production?
Nothing touches production until a human engineer reviews and approves every change. We back up the database before every migration, use a staging branch first and keep a rollback plan.
Is this a penetration test or a compliance certification?
No. It is a best-effort, fixed-scope fix of the common critical issues in AI-built apps (RLS, storage, exposed keys, env vars, auth redirects). Production deployment is included only in the $249 Fix & Deploy plan. It is not a penetration test, a security guarantee or a compliance certification.
Do you add features?
No new features. We fix security issues and get your existing app deployed. Each order covers one app, one Supabase project and one deploy target.
Get your app fixed and deployed.
From $149. 48‑hour turnaround. Full‑refund guarantee.