Database access
Check that each user can only read and change the data they're entitled to, including row-level security and tenant boundaries where relevant.
For founders building with AI
Built an app with AI? Let's make sure it's ready for real users.
You got your idea working. You might even have your first customers lined up. Before you open it to everyone, it's worth knowing whether your users' data, accounts and payments are protected.
We'll review your app, show you where the risks are and help you work out what to fix before launch.
Independent technical review · Australia-wide · Delivered remotely
YOUR APPREVIEWLAUNCH DECISION
Working demo
↓
Database accessAPI keysPayment events
↓
PRIORITISED REPORTWhat to fix before launch01 / Review access boundaries02 / Verify payment events
The launch gap
A working app isn't necessarily ready to launch.
AI tools make it easier to build something impressive. The hard questions are often invisible in a demo: can one customer access another's records? Can a privileged action run just because someone is logged in? What happens when a payment event arrives twice?
We review those foundations against how your app is meant to work.
Illustrative example
HIGHA signed-in user can request another account's invoice by changing its ID.
Why it matters
A login alone does not prove the user owns the invoice.
Recommended fix
Enforce account ownership on the server and test cross-account requests.
What we review
Six places launch risk can hide.
Authentication & permissions
Review login, sessions, recovery, privileged actions and whether server endpoints enforce permissions.
API keys & secrets
Identify public and privileged credentials, where they're stored, and whether any need rotating.
Payments & integrations
Assess payment webhooks, paid access, duplicate events and third-party permissions where applicable.
Production configuration
Review deployment settings, environment separation, error handling, logging, backups and recovery readiness.
Launch priorities
Separate findings that need attention before launch from improvements that can follow later.
Common questions
Know what actually matters.
A visible URL, a login screen or a tool's green check tells only part of the story. We look at the permissions and behaviour behind them.
Can anyone read my database if they find its URL?
A public endpoint or Supabase publishable key is not automatically a vulnerability. The important checks are database grants, access policies and authorisation.
Is an API key in my app dangerous?
Some keys are designed to be public. Privileged or billable keys belong on the server. We'll distinguish them and flag anything that needs moving or rotating.
Is a login screen enough?
Signing in establishes who someone is. Authorisation determines which records and actions they can access. We check both.
The AI builder says my app is secure. Is a review still useful?
Automated checks are useful. A review also tests how your product's roles, data boundaries and intended behaviour actually work.
Our process
A defined review with a useful outcome.
Show us what you've built
Tell us what the app does, its stack and whether it's live. We agree the review scope before access is granted.
Assess the high-risk paths
We inspect agreed code and configuration and test permissions using authorised accounts and data.
Get your findings report
Each finding includes severity, evidence, impact and a recommended fix. We walk through launch priorities together.
Choose how to fix it
Use your developer, handle changes yourself, or ask us for a separate remediation and re-check quote.
Your deliverables
A report you can act on.
- Written scope and review summary
- Critical, high, medium and low findings with evidence and recommended fixes
- A fix-before-launch list and separate improvement backlog
- A walkthrough and time for questions
- Clear documentation of what was not tested
This scoped technical review reduces uncertainty. It is not an exhaustive penetration test, regulatory certification or guarantee that an app is vulnerability-free.
ILLUSTRATIVE REPORT PREVIEW
Launch review
HIGHAccount access boundaryFix before launch
MEDIUMPayment event handlingPrioritise
LOWLogging and alertingImprove later
Typical platforms
Built with AI? We can look under the hood.
We review inspectable AI-assisted web apps built with Lovable, Bolt, Cursor, Replit, v0 or Claude Code. Common stacks include Next.js, React, Supabase, PostgreSQL, Firebase, Node APIs, Vercel and Stripe.
We'll confirm fit and access needs before accepting a more specialised stack.
Quick launch checklist
Before inviting real users
- Test a second account against the first account's records.
- Confirm privileged keys never reach the browser.
- Check paid access and duplicate payment events.
- Know who can restore data and respond to errors.
Investment
A defined review, not an open-ended project.
We'll agree the exact scope in writing before work starts. Larger apps, multiple tenant or role models, sensitive data, and complex integrations need a tailored quote.
Request an Audit QuoteStarter app reviewA$1,650including GST
For an eligible small, single-tenant web app with one user role, one database and up to one payment integration. Includes the scoped review, written findings and walkthrough described above. We confirm eligibility and access in the quote; remediation and re-checks are separate.
Why Ember Digital
Engineering judgement from someone who builds products.
Work directly with Jeremiah. He has built and supported production React and PostgreSQL applications, implemented role-based permissions, and worked on Stripe Connect payment flows and AI-assisted products.
His experience spans hands-on product engineering and technical leadership, so findings are explained in terms of what to change and why it matters to launch.
Jeremiah FlickingerFounder, Ember Digital
FAQs
Questions before we start.
Do I need to finish my app first?
No. A review at your current stage can catch structural issues before more features or users are added.
Can you review a Lovable, Bolt or Cursor app?
Often, yes, when we can inspect the source code, configuration and relevant services under an agreed scope.
Do you need passwords or API keys?
Do not send secrets through this form or ordinary email. We agree least-privilege access and temporary test accounts where appropriate.
Is this a penetration test?
No. It is a scoped architecture, configuration, code and permissions review with agreed testing. We can identify when specialist testing is needed.
What if my app is already live?
We can review a live app using an agreed safe test approach, then prioritise urgent findings. Production changes should have a rollback plan.
Can you fix the findings?
Yes, subject to scope and availability. Remediation and a re-check are quoted separately; you can use your own developer.
Will this guarantee my app is secure?
No review can guarantee that. You receive a documented assessment of the agreed areas and its limitations to support a more informed launch decision.
Get started
You've built something worth launching. Let's check the foundations.
Tell us what your product does, how it was built and where you are in the launch process. We'll recommend a sensible review scope.