SECURITY AUDIT · AI-BUILT APPS
You shipped your app in a weekend with Lovable, Cursor or Bolt. Nobody has checked whether it is secure. I review it by hand against the OWASP checklist and hand you a report with every hole and its exact fix. From €600, public pricing, EU-based.
A vibe coding security audit costs between €600 and €2,500, excluding VAT. Express (from €600) covers the full app-level OWASP checklist in 1-2 business days. Full (from €1,500) adds a deep review of RLS, secrets and authentication. Hardening (from €2,500) includes the fixes implemented as Pull Requests. Fixed prices, published here before you ever write to me.
from €600
Turnaround: 1-2 business days
For MVPs and AI-built apps not yet making money
Out of scope
from €1,500
Turnaround: 4-5 business days
For production apps with users or payments
Out of scope
from €2,500
Turnaround: 8-10 business days
For teams that want the problem solved, not just diagnosed
Out of scope
Prices exclude VAT: Spain +21%; EU businesses with a VAT number, reverse charge; outside the EU, no VAT applies.
The tool does not matter much: the pattern repeats. AI generates fast and leaves the same holes behind: keys in the code, Supabase RLS policies never configured, open API routes, default CORS and headers. I build with these same tools every day, so I know exactly where to look.
Apps with Supabase behind them. First things I check: RLS policies, anon and service_role keys, and what sits in public storage.
Custom code that grows very fast. I check authentication, input validation and secrets forgotten in the repository.
MVPs deployed in hours. I check environment variables, API routes and what got exposed to the browser by accident.
Interfaces wired to real APIs. I check what travels to the client and what should have stayed on the server.
I work from Barcelona and invoice from Spain. I review your app with GDPR in mind too: exposed personal data, forms sending information where it should not go, permissions that show more than they should. I do not certify compliance: I show you what is exposed and how to close it.
Your code never leaves my machine, I do not share it, and I delete it when the project closes. If you want an NDA, we sign it before you show me anything. EU businesses with a VAT number get a reverse-charge invoice; outside the EU, no VAT applies.
I do not leave you with a list of scares. In Express and Full, every finding comes with its severity, its real impact and the concrete fix: what to change, where, and why. In Hardening I implement the fixes myself as Pull Requests on your repository, with a verification re-test and 30 days of support.
And if you asked the AI to review its own code, you already know what it said: everything looks fine. It repeats the same blind spots it created. This is not a penetration test and not a certification: it is the honest review your app needs before facing real users.
I call this service VaultAudit. Same method, same pricing, under its own name.
Yes. The methodology is the same: the OWASP checklist applied to the application layer. AI-built apps are most of what I review because they are the ones that ship with the least review.
A written report with every finding: severity, impact and the concrete fix. In Full I also walk you through it on a 30-minute call. In Hardening, the fixes come implemented as Pull Requests.
Read access to the repository (or a ZIP of the code) and the app URL. If there is a database, the schema and its policies. That is enough for the Express.
No. It is an application-layer audit: I review the code and the configuration from the inside. I do not attack the app from the outside and I do not certify compliance (SOC 2, GDPR).
Express, 1-2 business days. Full, 4-5. Hardening, 8-10. Turnaround is part of the written proposal.
Book a 30-minute call or write to me on WhatsApp. It leads to a proposal with a fixed price and a fixed scope.
No pitch, no pressure. You tell me what you built, I tell you honestly whether I am a fit, and it leads to a fixed-price proposal.
No pitch, no pressure. Just a conversation about your app.