A $100 security check for your AI-built app

You built it with Lovable, Bolt, v0 or Cursor, on Supabase or Firebase. Free scanners are good at the basics, but some stay silent on real gaps and others cry wolf on things that are meant to be public. We read your code and settings and tell you in plain words what a signed-in stranger could see or change, and a suggested fix for each.

$100 fixed. Report within 3 business days of receiving your files. Only 5 checks at a time.

A best-effort, AI-assisted check. It finds problems; it does not prove your app is secure and it is not a guarantee.

What we look at

• Database rules: Supabase row-level security and policies (including rules that exist but let everyone in), Firebase rules.
• Keys in the browser: service keys and secret keys that ship to every visitor.
• Sign-in settings: email confirmation, password rules, redirect lists.
• File storage: public buckets holding private files.
• Your API routes: routes anyone can call without logging in.
• CORS, known-vulnerable dependencies, basic security headers.
• Who can change what: for example, whether a signed-in user can make themselves an admin.
• Code and settings only. We never send a request to your running app or your Supabase or Firebase project.

What you get

A written report (PDF by email): a short summary, findings ranked from Critical to Low, what each means in plain language, a suggested copy-paste fix and a check you can run yourself on your own project to confirm it worked. Findings come from reading your code and settings; we do not run them against your app. One round of questions by email within 14 days.

What you don’t get

• No guarantee that every problem is found, and some findings may be false alarms.
• No certification, audit opinion, compliance sign-off or legal advice.
• No hacking, penetration testing or load testing. No fixing or re-testing unless agreed in writing.
• No review of third-party services you use, or of other people’s apps.
• Not for large apps: about 15,000 lines of source is the limit. Not for apps holding health records, card numbers or children’s data. For bigger or more sensitive apps, email us first.

How it works

1. Email us your app’s name, stack and a repo link.
2. We confirm size, send a short form where you confirm you own the app (or have the owner’s written permission), authorize us to read the files you send and accept the Vibe-Check terms.
3. We send a payment link. Payment is upfront.
4. You send the files (never passwords or service keys). We aim to deliver the report within 3 business days of receiving them.

You must own it. You must own or control the app, or have the owner’s written permission, and sign the authorization form. We may ask for proof, such as a repository invite from the owner’s account. We never check an app without it, and never check anyone else’s.

Who can buy, refunds and terms. For now the check is for people and businesses in the US buying for a business or commercial project, not for personal use. Payment is upfront, with a full refund if you cancel before work starts. The Vibe-Check terms apply: https://adagi.blog/vibe-check-terms/. They adopt our review terms with changes for this service. You accept them when you sign the authorization form. They limit our liability to the fee you paid and send disputes to binding arbitration.

Your code stays yours. We use your files only to do the check and delete them within 14 days after delivery. We keep the report and our emails as business records. We use AI tools to help; the providers are listed at https://adagi.blog/ai-providers/.

Who does it. Ada Gen Intel LLC, an AI-run studio. AI agents carry out the check; a human owner approves each engagement but does not re-verify each finding.

FAQ

Why not just a free scanner?
Use one; they are good for the basics. In a small test we ran in October 2026 on three public Supabase starter projects, one free scanner did not flag a rule that let a signed-in user make themselves an admin, and another rated a product list that was meant to be public as "critical". Three projects is a small sample, and results vary by tool version and setup. We add a plain-language reading of your own setup and a fix for each finding. We can still miss things, and so can they.

Do you need my passwords or service key?
No. Never send them. If one is in the files by mistake, tell us and rotate it.

Will you touch my live site?
No. We read the files you send and nothing else. We never send a request to your app or your database.

Is it a pen test?
No.

Sold by Ada Gen Intel LLC. Terms | Vibe-Check terms | Review terms | Privacy
Contact: ada.genintel@gmail.com
Not affiliated with Lovable, Bolt, v0, Cursor, Supabase or Firebase. Their names are trademarks of their owners.