Your developer says it’s done. You have no way to check.
An independent review of your AI-built or outsourced app — before the next milestone payment, the first customers, or the ad spend. Plain English. Three pages. One decision.
What you actually built
- The tool that generated it
- Browser UI
- Frontend and route handlers
- Auth and session
- API routes and server actions
- Database
- Third-party providers
One tool generated all of it. The risk is not inside any box — it is where the boxes meet.
Auth → user data
Can one user reach another user's records?
API route → database
Are ownership checks enforced server-side?
Third-party token → storage
Are tokens stored and scoped safely?
Client → privileged operation
Can the browser do what only the server should?
Deployment → runtime logs
Can failures be observed after launch?
How I look at it
The gates that apply to your stack, in order. Each one has a way it fails and a question that settles it.
Supabase
An authenticated user can read or write another user's rows.
Can user A list, read, update, or delete user B's data?
Firebase
Security rules allow reads or writes the product never intended.
Are rules tested against a second signed-in user, not just the owner?
Cloudflare
Edge configuration exposes origin or bypasses access controls.
Can the origin be reached directly, around the edge?
Hosting
Preview environments carry production secrets.
Are environment values separated between preview and production?
Stripe and billing
The payment webhook is not idempotent, so a retry charges or grants twice.
Does replaying the same webhook change the outcome?
Auth boundary
Ownership is checked in the interface but not on the server.
Are privileged operations enforced server-side?
Monitoring
A failure in production leaves no trace anyone can find.
Can failures be observed after launch?
What you get
Founder Summary
Sample — written against a fictional product, not a client's app.
The decision
Continue, fix first, or stop — in one line, with the reason.
What I’d fix before the next milestone
The items that change the decision. Never more than three.
What can wait
Named explicitly, so the list you are given is the whole list.
About your current developer
What the code says about how the work was done.
What I looked at
The scope of the review, so you know what it does not cover.
If you want the detail
Where the full findings live, for the person who will fix them.
Scope
One week. $1,200 fixed.
What this includes
- Executive launch-readiness summary
- Platform map: frontend, backend, DB, auth, storage, billing, hosting, edge, observability
- Trust boundary table: public and browser-visible versus server-only versus privileged
- Data boundary test notes: cross-user access, storage policies, tenant isolation
- Money boundary test notes: webhooks, idempotency, billing role mutation
- Risk table: severity, likelihood, evidence, suggested fix
- Quick wins: one to three day fixes
- Next sprint plan: 7, 14, or 30-day options
What this does not include
- Full rewrite
- Penetration test certification
- Legal or compliance certification
- Guaranteed security claim
- Production deploy without explicit approval
Why me
Six years of engineering, an app of my own shipped to the App Store, and front-end lead on a public-sector platform. I publish the method before anyone pays for it — the checklist I work from, the way I read a stack, and the writing behind both are open, so you can judge the work before you commission it.