You vibe-coded something great. Let's make sure it isn't exposing customer data.

We scan only what's publicly accessible from your app's URL — the same things any visitor to your site could observe. This includes your HTTP security headers, any API keys or credentials accidentally left in your public JavaScript, your SSL certificate configuration, publicly accessible API endpoints, and observable security patterns specific to AI-generated code.

We don't scan anything behind a login, your source code, private databases, or third-party services. We also don't attempt to exploit or attack anything — we observe and report. See our Security Disclaimer for the full scope.

Possibly not for the landing page itself — but if your form sends data anywhere, connects to a backend, or stores anything about users, then yes. Some of the most serious exposures we've found were in apps the founder described as "just a simple form." The form submit endpoint, the database it writes to, and the API keys in the JavaScript that powers it are all worth reviewing. The General Report is designed exactly for this situation.

We'll be honest with you: no security review — ours or anyone else's — can guarantee your app has zero vulnerabilities. We find what's observable from the outside against our 40+ check methodology, which covers the most common and critical issues in AI-built apps. But authenticated areas, business logic flaws, and zero-day vulnerabilities are outside our scope.

What we can tell you is that after fixing the issues in your report, your app will be dramatically better protected than it was — and better protected than most other AI-built apps currently live. We're a strong starting point, not a final destination. See our Security Disclaimer for the complete picture.

Instant Report: Generally an hour from payment. We queue your scan as soon as payment is received.

Human Review: Within 1 business day, most times within a few hours depending on demand. A member of our team personally reviews everything, and delivers the report.

Deep Audit: Priority responses. Within a one business day, most times within a few hours depending on demand.

Business hours are Monday–Friday, 9 AM–5 PM Eastern. Submissions received outside those hours are processed first thing the next business day for the human review component.

Every finding includes a step-by-step fix checklist written in plain English — designed to be copy-pasted into a message to your developer, or used directly as a prompt in Cursor or ChatGPT. Most fixes are well-documented and your AI tool can implement them with the right prompt.

On Human Review and Deep Audit plans, you also get follow-up questions answered via email. And if you're genuinely stuck, email us — we're happy to point you in the right direction. We'd rather help you fix it than leave you with a report you can't act on.

We only scan publicly accessible information — the same things any visitor to your site could see. We never access private databases, authenticated areas, or source code.

Scan results are used exclusively to generate your report. We don't store your source code (we never see it), and we never share your specific findings publicly. We may use anonymized patterns across many apps to improve our methodology, but nothing that could identify your app. See our full Privacy Policy.

For investors: absolutely. Founders regularly use their Human Review and Deep Audit reports during fundraising to show they've taken security seriously. The Deep Audit includes a shareable security summary and a clean bill of health certificate specifically for this purpose.

For regulatory compliance (HIPAA, SOC 2, PCI DSS, GDPR): our reports are not formal compliance certifications and should not be presented as such. They're a strong signal that you're approaching security thoughtfully, but formal compliance requires certification from an accredited assessor. See our Security Disclaimer for details.