Offer 2 of 5 · Vibe-code hardening & audits

Your AI-built app works. That's not the same as safe.

Lovable, Bolt, and Cursor ship apps fast and leave the same holes every time: the service-role key in the browser bundle, RLS switched off, ownership never checked, no rate limit on login. I find them, prove each one with a working exploit, then close it and prove it's closed.

For: solo founders and small teams with a shipped AI-built app and "fix / secure my Lovable app" on their mind.

What I check and fix

Secrets in client code: service-role keys, API keys, and .env files that shipped to the browser.
Row-Level Security: tables with RLS disabled or a permissive using(true) policy exposing every row.
Authorization: BOLA/IDOR on resource routes, mass assignment (self-promotion to admin), missing authz on admin endpoints.
Input validation, per-user rate limiting, and an origin allowlist instead of wildcard CORS.
Storage bucket policies, structured logging with header redaction, and PII redaction before any model call.
An eval harness and exploit tests, so every fix is backed by a test that fails on the old code and passes on the new.

The metrics from the reference engagement

19	vulnerabilities catalogued
5	rated critical
21, then 52	exploit tests: first proving the holes, then proving closure

Every finding carries an exploit walkthrough and a linked proving test. Findings are worded as point-in-time observations of authorized systems only.

Proof: read the work before you buy

Before / after hardening case study

A real SaaS in two branches: the app as the AI shipped it, and the hardened version. The diff is the pitch.

19 findings Code

Sample audit report (redacted)

The exact deliverable you receive: exec summary, a 16-row findings table (the same finding classes as the case study, consolidated and redacted for a client), exploit walkthroughs, sequenced fix plan, re-test checklist.

Read report

vibe-audit: open-source scanner

CLI that flags secrets, service-role keys, missing RLS, public buckets, unvalidated webhooks and more. Run it yourself first.

Code

Find-the-12-holes playground

A deliberately vulnerable app with 12 planted real-world holes and the answer-key write-up for each.

Code

Send me the app and the platform it was built on.

Lovable, Bolt, Cursor, Supabase: tell me the stack and whether it's live. I'll scope the audit and, if you want, the fix.

amin.ale.business@gmail.com