Parcourir les catégories
Explorer
Fiverr Pro
Français
$
USD
I will audit and fix security issues in your ai generated vibe coded app
FELIX
À propos de ce service
Your app works. That is exactly the problem.
AI builders ship apps with RLS switched off, service role keys sitting in the frontend bundle, and API routes any stranger can call from a browser tab. Everything looks perfect right up to the morning one user opens another user's data.
I audit AI generated codebases before they embarrass you.
WHAT YOU GET
Exposed secret scan: service role keys, API keys and tokens in client code and git history
RLS and authorization audit: I actually test whether user A can read or edit user B data
Auth review: session handling, role based access, unprotected admin routes
Input validation, rate limiting and file upload safety checks
Dependency vulnerability report
A written report ranked by severity, plus the fixes applied
Lovable, Bolt.new, v0, Replit, Emergent, Cursor, Base44 or CatDoes. I know what each one gets wrong.
WHY ME
Genuine cross user privacy testing, not an automated scan you could have run yourself
Every finding comes with the exact file, the line, and the fix
NDA friendly. Read only access is perfectly fine to start
Message me before you launch. Cheaper than a breach, and much cheaper than the apology email.
Découvrez FELIX
FELIX
React Native Supabase Developer Expo builds, RLS, payments, App Store deploy
- DeFrance
- Membre depuisaoût 2026
- Temps de réponse moy.9 heures
Langues
Anglais, Espagnol
I fix apps that AI built and then abandoned.
Lovable, Bolt.new, v0, Replit, CatDoes and Cursor are brilliant at generating screens and genuinely terrible at everything behind them. Supabase RLS, Expo builds, Stripe webhooks, App Store review. That is the part where founders get stuck for three days and I get unstuck in one.
React Native, Expo, TypeScript, Supabase, Postgres, Stripe, RevenueCat, Vercel.
Send me the error message, not an apology for it. I have seen worse. I will tell you what is wrong before you pay me anything.
FAQ
Do I need this if I only have a handful of users?
That is the cheapest possible moment to do it. Fixing an authorization model with 20 users takes an afternoon. With 20,000 users it becomes a migration, a legal problem, and a public apology.
Will you sign an NDA?
Yes, gladly, before I receive any access at all. Read-only repository access is enough for me to start.
What is a cross-user data leak, and how do you test for it?
I create two test accounts and, logged in as account A, attempt to read and modify account B's data. If anything comes back, you have a leak. It is the single most important test and almost nobody runs it.
What is the single most common vulnerability you find in Lovable, Bolt and Replit apps?
The Supabase service role key exposed in frontend code. That one key bypasses every security rule you have. Anyone who opens browser DevTools effectively owns your entire database.
Is AI-generated code really insecure, or is this scaremongering?
It is frequently insecure, and not because the AI is careless. It optimises for does the screen work. Turning RLS off makes the demo work instantly, so it stays off. Nobody audits code they never wrote.
