A focused engineering review for founders shipping with Lovable, Bolt, Cursor and Replit, before real users, data and payments depend on it.
See a sample reportReport within 48 hours of access · one critical fix included · fixed price
AI tools often put secret keys where any visitor's browser can read them.
A missing database rule can expose every user's records to one logged-out request.
Unverified webhooks and missing retries mean lost orders, or orders marked paid that weren't.
Read-only repo access and your live URL. A short form covers your stack.
The 20 checks, run against your code and your deployed app.
Risks ranked by business impact, a fix plan, one critical fix done, and a 30-minute walkthrough.
The plan works on its own. If you want help, the Fix Sprint has a fixed price.
Excerpt from our lab audit of demo-shop, an app we built ourselves with deliberate flaws. It contains no client code or data.
With Supabase's default grants, anyone holding the public anon key (shipped in every page load) can list every order, including customer emails and delivery addresses.
Fix (done): audit/fixes/0002_orders_rls.sql enables RLS; customers read and create only their own orders, new orders must start as pending, admins read all.
Vite copies every VITE_ variable into the public JavaScript. Anyone can open the site, copy the key, and issue refunds, read customer data or create charges on the Stripe account.
Fix: move Checkout Session creation into an Edge Function that holds the key server-side; rotate the key in Stripe.
The handler never checks the Stripe-Signature header. Anyone who finds the URL can send a fake "checkout completed" event and mark an unpaid order as paid.
Fix: verify the signature with the webhook signing secret (stripe.) before reading the payload; record processed event IDs.
Software Engineer (Data & AI)
I'm Pelumi, the engineer behind Forthbeam. I build backend, data and AI systems for real business operations, where "mostly works" isn't good enough.
AI coding tools get an app working fast. Making it safe for real users, data and payments takes engineering judgement. I review every audit myself, explain the risks plainly, and give you a prioritised fix plan.
Lagos, Nigeria (UTC+1) · Founders worldwide · Async-first
20launch checks
I review your code and live app, rank the risks by business impact, and give you a fix plan. One critical fix is included.
See the 20 checksApps that store card numbers or medical records, or anyone needing a formal penetration test or compliance certification. No review can promise zero vulnerabilities; the audit finds and ranks the ones that matter most.
Apps built with Lovable, Bolt, Cursor, Replit or v0, typically on React or Next.js with Supabase or Firebase, plus Python and Node backends.
Read access to the repo, the live URL, and a 5-minute form. Database access only if you choose to grant it.
Then the report says so, with evidence, and you launch with confidence. That is worth knowing too.
If the report isn't delivered within 48 hours of receiving access, you get a full refund and still keep the report.
Both. The audit includes one critical fix. The Fix Sprint covers the rest at a fixed price agreed before work starts.
By card through our checkout. Sprints are 50% upfront and 50% on handover.
Start with a free 20-minute check, or go straight to the audit.