For apps built with AI tools
Launch without leaking your users’ data.
We test your app before your users do, the way an attacker would, then send the fixes as a pull request.
- Lovable
- Bolt
- Replit
- Cursor
- Claude Code
- v0
- Supabase
- Firebase
- Stripe
- OpenAI and Anthropic APIs
What we look for first
AI tools build fast and make the same mistakes every time.
None of them show up when you click around your own app as yourself.
- CriticalRow-level security is offA table has no policy, or the policy is just true. Your public key is in the JavaScript, so anyone can read every user’s rows with it.
- CriticalSecret keys in the browserThe service-role key, the Stripe secret or the AI provider key shipped in the client bundle. Open dev tools, search for it, done.
- HighChange the ID, get someone else’s dataThe route checks that you are signed in, not that the record is yours.
- HighUnsigned Stripe webhooksThe webhook never checks the signature. Anyone can post "payment succeeded" to it and unlock a paid plan.
- HighAn AI endpoint with no limitsNo rate limit and no spend cap. One script runs up your bill overnight.
- MediumStorage anyone can listFirebase rules still in test mode, or a bucket that lists its files. Uploads are one guessed link away.
Scanners tell you what is wrong. We send the pull request that fixes it.
Every Critical and High finding comes back as a pull request against your repo, with a note on what changed and why. You review it and merge it. We never deploy and never touch production.
Prices
Fixed prices, paid upfront, no call needed to find out.
The cheapest way in
Starter Check
A$390
plus GST
3 business days. One app, tested by hand with two accounts.
- Database rules: can one user read another’s data
- Secret keys in the bundle or the repo
- Stripe webhook signatures
- AI endpoints: rate limits and spend caps
- Report, worst first, with how to fix each one
- The full A$390 comes off a Launch Check booked within 30 days
Most apps choose this
Launch Check
A$1,190
plus GST
5 business days. One app, one repo, up to 20 routes or functions, one database, up to two integrations.
- Tested with two accounts trying to reach each other’s data
- Database rules, ownership checks, keys, webhooks, AI limits
- Report, worst first
- Critical and High fixes as a pull request
- 30 minute walkthrough
- One re-test within 14 days
Teams and bigger apps
Launch Check Plus
A$2,190
plus GST
7 business days. Up to two repos, 50 routes, multi-tenant, up to five integrations.
- Everything in Launch Check
- Data separation between teams or organisations
- Prompt injection against what your AI features can reach
- File uploads and admin paths
- Critical, High and Medium fixes as pull requests
- An access-control test suite that runs in your CI
After a Launch Check
Release Guard
A$390
per month, plus GST
Cancel any month.
- Up to 4 hours a month checking new code before you release
- Your CI test suite kept up to date
- Same-day reply on anything critical
Prices in Australian dollars, plus GST. Need a Launch Check in 3 business days? Add 50%. Anything outside the scope is A$150 an hour, quoted in writing first. We take one Launch Check at a time, so ask for a start date before you plan around one.
How the five days run
From signed scope to merged fixes in a week.
Day 0
You sign the scope and pay
Then you give us read access to the repo, a member invite to your Supabase or Firebase project, and two test accounts.
Days 1 to 4
We test, then write the fixes
Every table, every route that takes an ID, every key, every webhook. One pull request per finding or small group.
Day 5
Report, pull requests and a call
We go through it with you in 30 minutes. When you have merged the fixes, we re-test what failed.
What we will never do
- Ask for your password. We work from an invite you can revoke.
- Merge, deploy or change anything live. You stay in control of what ships.
- Test anything without a signed scope, including the free check.
- Touch real payments. Stripe stays in test mode, and an AI spend cap goes on before we start.
- Hold on to your data. Working notes are deleted 30 days after the final report.
Who does the work
An application security engineer with professional experience in web and API security testing in the financial services industry.
ANPO Digital is a small practice based in Melbourne. We work with founders across Australia, in your time zone, by email and video, and the person who tests your app is the person on the call.
Not ready to pay? Start with a free check.
We look at the public side of your live app: what is in the JavaScript bundle, exposed keys, headers, and any database or storage endpoint the public key can reach. You get three findings by email within 2 business days, after you confirm you own the app and sign a short authorisation.
Ask for a free checkBook a Launch Check
Ship it knowing it holds.
Send us the app's URL, what it is built with and when you want to launch. We reply within one business day with a start date and the scope to sign.