I check your AI-built app before it goes live, and you get back what I find, ranked by risk, with the file and line for each one and how to fix it.
$299The Launch Check covers your logins, keys, payments, data access and what happens when something fails, and it’s credited toward any fix.
The call is free, and once you’ve told me what you built, you’ll know whether a Launch Check makes sense for it before you’ve spent anything.
Every incident below was reported in public in 2025 or 2026, and each one links to its source. In your report, every check gets a result, with what I looked at and the file and line for anything I find.
I look at sign-up, sign-in and password resets, and at who counts as an admin. If your app decides who’s an admin from a field users can edit on their own profile, any signed-in user can make themselves the admin with one line in the browser.
In February 2026 an exam app on an AI app builder’s showcase had its admin check written backwards. It blocked signed-in users and let strangers in, and a researcher counted about 18,700 user records open.
A Launch Check would likely have caught it, because I read every guard like that one and ask who gets in when nobody’s signed in.
The Register, Feb 27, 2026I look at where your keys live, your OpenAI key included, and whether any of them reach the browser or your git history. A key whose name starts with VITE_ ends up in the JavaScript every visitor downloads.
In March 2025 a solo founder posted that AI wrote all of his paid app. Two days later his API keys were maxed out, people were skipping his subscription and junk was filling his database.
He never said what the mistakes were, but keys, payments and who can write to your database are three of the five checks, so a Launch Check would likely have caught them.
His post on X, Mar 17, 2025I look at your Stripe webhooks, where your prices come from, and what marks an order as paid. If your checkout takes its price from the browser, a buyer can change one number and pay what they like.
In 2025 researchers checked 1,645 apps on an AI app builder’s showcase and found 170 where strangers could read users’ names, phone numbers and payment details, and on one app they marked an order “paid” without paying. The finding became CVE-2025-48757, which the builder disputes.
A Launch Check catches that kind of mistake, because the main question it asks is what marks someone as paid, and the only right answer is a webhook whose signature you’ve verified.
NVD, CVE-2025-48757I read your Supabase rules, called row-level security, and every route that reads or writes user data.
Moltbook went viral in January 2026 with its database open to anyone. Wiz counted 1.5 million API keys, 35,000 email addresses and thousands of private messages anyone could read, all because one setting was off.
That setting, row-level security, is the first thing this check looks for, so a Launch Check catches it.
Wiz, Feb 2, 2026I look at what your app does when a card is declined, an API times out, a step half-finishes, or a login check hits an error and quietly lets everyone through.
In March 2026 a vibe-coded dashboard at METR, an AI research nonprofit, quietly switched its login off. A stranger then used its AI key for three weeks, about $600,000 worth of credits, which had been donated.
What your app does when a check like that breaks is one of the first things I look at, because the safe answer is that nobody gets in. A Launch Check would likely have caught the broken login.
METR, Aug 31, 2026To show the check at work, I built a test app with these same mistakes and ran a Launch Check on it, and the sample report shows everything it found.
The highest risk comes first, and each finding names the file and line, what breaks, what it costs you and how to fix it.
See a sample reportIt’s one offline file you keep, which opens in any browser with no server or account and shows how your app fits together before it walks through the code.
Try a live tourWe go through the findings together and you ask anything, and then you decide what to fix.
Read-only access to your repo and your OK in writing are all I need, and an email is enough for the OK. I don’t need your passwords, your keys or your live app.
You get the ranked findings and the tour of your code three business days after I have access.
You can fix it yourself from the report, or have me fix it in a Rescue Sprint, and the $299 comes off any fix I do.
My own scan reads your code and its whole git history with no AI and lists leads, like keys in old commits and tables without row-level security. Then Claude Code agents read a copy with no history and no secret files, with tools that can read and search but can’t change anything. Nothing goes in your report until I’ve opened the file and agree with it.
I build a tour of your app with repo-tour, which picks the few files that hold it together and walks through them, how the parts fit first and then the code. You keep the tour as one file that opens offline.
It reads Python, JavaScript, TypeScript and TSX, and Claude writes its explanations from the lines on each stop and an outline of your app.
If your app is written in Python and has tests, I record a run of them with state-map. It plays any test back step by step over a map of your functions and shows which functions no test reaches.
It needs Python 3.12 or later, and most apps from AI app builders are TypeScript, so they get no replays and I check them by reading the code. It runs with the network off and uses no AI model.
The demo’s bug is an order that totals −$2.80. In a 2026 study by a security firm, 4 of 5 AI coding tools built shops that would take an order with a negative total.
repo-tour and state-map each run a small server, and both listen only on my own machine, so nothing is open to the internet.
It’s one fixed price in that range, set from your report before I start, and your $299 Launch Check comes off it. You can also fix it yourself, since the report says what to change, file by file.
No. I work from a read-only copy of your code on my own machine, and I don’t sign in to your app, change its settings or touch your users’ data. If I run its tests, I run them on that copy, never against your live app.
Yes. I work with Claude, Anthropic’s AI, including Claude Code agents, which read the read-only copy of your repo on my machine and may run its tests there. The files they read are sent to Anthropic while I work, and the agents never get your keys, your passwords or your live app.
For your tour, repo-tour sends Claude the lines it explains, usually about six files’ worth, along with an outline of your app and any file I ask its tutor about. Inside repo-tour the model gets no tools, and state-map, the test recorder, uses no AI at all.
If you’d rather no code went to any AI service, tell me on the free call, and I can do the check without one, though it takes longer.
repo-tour reads Python, JavaScript, TypeScript and TSX, which covers most apps from AI app builders, and I read your database rules, which are SQL, directly. Test replays need Python tests on Python 3.12 or later, so a JavaScript or TypeScript app gets all five checks without replays. If yours is built with something else, ask on the free call, and you’ll know there whether it’s a fit.
No check can stop an agent from acting. In April 2026 an AI coding agent deleted a small software company’s live database and its backups in 9 seconds, and car-rental businesses lost their bookings until the host restored them. What I can do is find the commands and keys your agent can reach, and ask where your backups live and when you last restored one, which reduces the damage.
Then each check in the report shows as clear, with what I looked at, and you still get the tour of your code. In the sample report, the payment webhook is an example of a part that came back clear.
Nobody can promise an app is secure, so I won’t. What I can do is the five checks, done carefully, with the file and line for anything I find. A clean result means those five passed, and it doesn’t mean nothing else can go wrong.
I’m Evan Brown, and I run GIMS Technologies from Highlands Ranch, Colorado. AI agents build my software ticket by ticket, and I check what they write before anything ships. I work remotely with anyone, and in person around the Denver south metro. More about me
Tell me what you built and when you launch, and we’ll work out together whether a Launch Check makes sense.
