Hardening Audit. Before your customer’s security officer reads it.
You built it with Lovable, Bolt, Claude or Cursor, and it works. Now someone wants to know whether it is safe. We read your app the way an attacker and an auditor would, and tell you plainly what to fix — or whether to rebuild.
The three places AI-built apps usually break.
Not a generic scan report with four hundred warnings. A senior engineer reads your code, your database rules and your deployment, and ranks what would hurt first.
Who can see what
Authentication, authorisation, database access rules, exposed keys, injection — checked against OWASP ASVS. The leaks that made the news were almost always here.
Will it hold a second customer?
Separation of data per customer, payments, audit trail, privacy features, and whether the structure can grow without being rewritten.
What happens at 3 a.m.
Backups you have restored, logging, monitoring, where your data lives, and what a NIS2 supplier review will ask you about it.
One report you can act on. And a straight answer.
Findings ranked by what hurts first, each with the fix. Then the verdict nobody else gives you in writing: patch what you have, or rebuild it properly. If it is the second, we will tell you what that costs in the SaaS Factory — and you are free to take the report to anyone else.
- CRITtable readable by any signed-in user
- HIGHservice key shipped in client bundle
- MEDno data separation per customer
- LOWbackups never restored
- VERDICTrebuild · keep the flows
The questions everyone asks
My platform already scans my app. Isn’t that enough?
Keep the scanner on; it catches real things. A scanner tells you about known patterns in your code. It does not tell you whether your data model can separate two customers, whether anyone has ever restored a backup, or how to answer question 34 of a supplier questionnaire.
What do you need from us?
Read access to the code and the database configuration, a test environment, and an hour with whoever built it. A mutual NDA and a processing agreement come first, before we see anything.
Do I have to rebuild with you afterwards?
No. The report is yours. If the honest answer is “fix these five things and carry on”, that is the answer you get.
Got the questionnaire already? Send it along.
We will tell you which answers the audit gives you, and how fast. If you already know the prototype was the sketch, skip straight to the product and start with a Factory Sprint.
Hardening Audit · fixed price · credited to a Sprint or rebuild