Find what's exposed before your users do.
We audit your site or app for real vulnerabilities (SaaS, e-commerce, or anything web-based), whenever you need it, not just before launch. Especially critical if it was built fast with AI tools like Cursor, Claude Code, Lovable, or Bolt, which quietly ship the same mistakes.
From €59 · NDA by default · Read-only access · 48h turnaround
Security Review Report
acme-app · reviewed Jul 14
Security score
/ 100
Findings by severity
- Row-Level SecurityCritical
- Public Storage AccessWarning
- API Key ExposureWarning
- Authentication FlowPassed
Is something in your app exposed right now?
One command. 60 seconds. Run it on your own app.
No spam. The test, then nothing unless you ask.
Tested on our own products, then validated on real client engagements
AI helps you ship faster.
It also helps you ship vulnerabilities faster.
| Symptom | Cause | How we check it | |
|---|---|---|---|
| Broken RLS | Your app works perfectly, but any user can see another user's data through the API. | Row-level security missing or misconfigured on your database tables. | Table-by-table policy audit, verified with a two-account cross-access test. |
| Leaked API Keys | Everything runs fine until someone opens dev tools and finds a key that shouldn't be there. | Secret keys committed to the repo or shipped straight to the browser bundle. | Full scan of source code and the client bundle for exposed keys and tokens. |
| Public Storage | A file you thought was private shows up in a search engine or a random link. | Storage buckets left open, indexable, and downloadable by anyone. | Bucket-by-bucket access test, with and without authentication. |
| Weak Authentication | Someone can hammer the login form as many times as they want. | No rate limiting, weak sessions, or missing checks on auth flows. | Login, reset, and session flows tested against repeated and forged attempts. |
| Exposed Secrets | The app works fine in production, but nobody's sure which environment variables are actually private. | Environment variables and tokens visible in client-side bundles. | Client bundle audited line by line for anything that shouldn't be public. |
| Prompt Injection | A user pastes something strange into a text field and your AI feature starts doing things it shouldn't. | Unvalidated inputs let users hijack your AI's instructions. | Input handling reviewed against known prompt-injection patterns. |
This isn't hypothetical: in 2025, security researcher Matt Palmer found that 170 of 1,645 scanned Lovable apps (about 10%) had missing or misconfigured Supabase row-level security, exposing user PII, API keys, and payment data across 303 endpoints. (CVE-2025-48757, mattpalmer.io)
Traditional security reviews miss AI-built apps.
AI-built applications fail differently, and much earlier, than what traditional pentest checklists are built for.
| Traditional pentest | Validra | |
|---|---|---|
| Price | €5,000–€20,000+ | €29–€349 |
| Turnaround | 2–6 weeks | 24h–5 business days |
| Scope | Broad infrastructure checklist | AI-specific failure modes: RLS, secrets, auth, webhooks |
| Deliverable | Generic compliance-oriented report | Plain-English report, prioritized, with a walkthrough call |
Real vulnerabilities, found on real projects.
Three anonymized examples of what we actually find, not theoretical scenarios.
Complete bypass of row-level security rules
Supabase RLS policies were misconfigured, letting any authenticated user read and modify other users' transaction data through direct REST API calls, without ever going through the UI.
Business impact
Exposure of financial data for every user on the platform.
Authentication token exposed in URL parameters
A JWT was passed as a query parameter instead of a secure header, ending up logged in plain text in server logs and browser history.
Business impact
Risk of session hijacking for anyone with access to logs or browser history.
Public storage bucket with no access restrictions
Documents meant for internal use only were publicly accessible via a predictable URL, with no authentication required.
Business impact
Exposure of confidential company documents to anyone who knew or guessed the URL.
Anonymized examples from real engagements. Details modified to protect client confidentiality.
What we check, and what you get.
Six critical categories, checked with automated tooling and manual testing. Delivered as a clear, prioritized report, plus a call to walk through it with you.
Submit your project.
Share your repo or staging URL. It takes less than five minutes.
We review your application.
Automated scanning plus a manual pass from someone who ships AI-built products themselves.
Receive a prioritized action plan.
Clear, ranked fixes your team can act on right away, without jargon.
Row-Level Security (RLS)
We map the tables your app exposes through the API, then attempt cross-account access between two real test accounts on each one to confirm real data isolation.
Secrets management
Source code and the shipped JavaScript bundle are analyzed to catch any key or token exposed on the client side.
Storage permissions
Each storage bucket is tested with and without authentication to identify unintended access.
Authentication flows
Login, password reset, and session handling are tested, checking for rate limiting on repeated attempts.
API surface
We enumerate your exposed endpoints and test them unauthenticated, then again with a lower-privileged role, prioritized by what actually touches user data.
Third-party integrations
Webhook signature validation (Stripe and others) is checked to prevent forged requests.
Delivered as
Built by SaaS founders.
I build my own AI products. I know the shortcuts.
I know the mistakes AI coding tools still make.
I review products like a founder, not an auditor.
I don't start from a generic checklist. Every engagement sharpens my methodology: I document every mistake I find across Supabase and Next.js stacks, and the AI coding tools founders actually use today (Cursor, Claude Code, Lovable, Bolt, v0).
Téo Brondel
Founder, Validra
Founder of Validra. I've been building SaaS products for over two and a half years, long enough to see, firsthand, every security issue AI quietly introduces into code. Catching them before they turn into a breach became non-negotiable.
48h
Average scan turnaround
Live
New audits underway right now
6
Critical categories checked
Systematic severity rating
Every finding is ranked by real business impact, not just a technical score.
Documented methodology
Automated scanning plus manual testing of authentication, RLS, APIs, and storage.
Simple, honest pricing.
No seats, no contracts, no enterprise sales calls. Not sure where to start? Most founders begin with the Quick Check.
Quick Check
A fast expert look at your app before you commit to a full review.
- Expert first look at your riskiest surfaces (auth, data access, secrets)
- A plain answer: ready, not ready, or needs a full Review
- Delivered within 24 hours
Security Scan
Automated scan plus a manual spot-check by an engineer.
- Everything in Quick Check
- Manual spot-check by an engineer
- Priority findings summary
- Delivered within 48 hours
Security Review
Complete review. Business impact. Full report. Call included.
- Everything in the Scan
- Full manual code review
- Business impact analysis
- Prioritized roadmap + PDF report
- Delivered within 5 business days
Pick this if, don't if.
Pick this if…
- You're launching this week and want a clear go/no-go
- You just found an exposed key or an RLS gap and need it confirmed
- Investor or customer diligence is coming up
- You built with Lovable, Bolt, or Cursor and never checked the access rules
Don't pick it if…
- You're mid-breach right now — email me directly instead
- You need HIPAA, SOC 2, or PCI accreditation, not a technical baseline
- Your codebase is 100k+ lines — let's talk scope first
Good questions.
Do you sign an NDA?
Yes. We sign an NDA before we look at a single line of your code.
Do you need GitHub access?
Read-only access is enough. We never need write or admin permissions.
Which frameworks do you support?
Next.js, React, Supabase, Firebase, and most modern stacks, including AI-assisted tools like Cursor, Bolt, Lovable, and v0.
How long does it take?
A Scan takes 48 hours. A full Review takes about 5 business days.
Can you fix the issues?
We hand you a prioritized action plan. If you'd rather we fix it directly, that can be scoped separately.
Is my source code confidential?
Always. Your code is reviewed under NDA and never stored longer than the engagement requires.
Do you work with pre-launch projects that don't have real users yet?
Yes. That's actually the ideal time. The Security Scan is built specifically for this stage, before real data is on the line.
What happens if you don't find any critical vulnerabilities?
You still get a full report confirming the state of your application, along with the points to watch as you keep shipping new features.
25 mistakes AI coding tools still make in production.
6 categories, 25 vulnerabilities, freely available
Ready to see what's exposed?
Get a clear, prioritized report you can act on right away.