AI builders are good at making an app work and less good at making it safe to share. The common problems are small and fixable, and they are also the ones that expose customer data. We review your app, give you a written report in plain language, and fix what you approve. Based in Melbourne, working with founders and small businesses across Australia.
Send enquiryNot quite what you are after? This page is about exposure, not bugs. If the app misbehaves, you want help with a broken vibe-coded app. If your WordPress site has been hacked, see malware removal. If the app is ready and you want it live, that is launching a vibe-coded app.
Australian team
Based here, working your hours, not a timezone away
projects delivered
Over 10+ years building and maintaining sites for Australian businesses
One developer, start to finish
The same person every time: no re-explaining your site
Straight answers, on your terms
We only take work we can finish. Ask us anything first: no obligation
API keys placed in code that is sent to every visitor's browser. Database tables with no row-level rules, so any signed-in user can read every other user's rows. Storage buckets set to public. Login checks that happen only in the browser and can be skipped. Payment webhooks that accept any request without verifying the sender. Admin pages that hide a link instead of checking who is asking. None of these needs advanced skill to exploit, which is why they are worth checking first.
We read the code and the settings of the services behind it: where secrets are kept, how the database decides who can see what, what the storage permissions are, how sign-in and sessions work, how webhooks are verified, and which routes act without checking the caller. We also look at third-party packages the builder added and at what the app sends to the browser.
A short document in plain language. Each finding says what it is, where it sits, what someone could do with it, how serious we think it is and what the fix involves. Findings are listed in the order we would fix them, with an estimate of the work. It describes what we looked at, and it is equally clear about what we did not look at.
Only after you approve it. The report comes first and you choose which findings to fix. Keys that have already been exposed are the exception to "leave it for now", because they should be replaced regardless, and we explain how.
A review reflects the code on the day it was read. It cannot show that an app is free of faults, and later prompts can add new ones. We do not describe an app as secure. We tell you what we found, what we fixed and what is still open, so you can decide what to do before real customers sign up.
Open the live app, view the page source and search the downloaded scripts for strings that look like keys. If a secret key shows up, treat it as public and replace it. The check does this and goes further into the server settings.
Yes, and that is the cheaper time to do it. Fixing a table rule before anyone signs up is easier than after.
We do not give legal advice. The report covers technical exposure. If your business handles personal information, a lawyer or privacy adviser should confirm what applies to you.
Yes, once you have approved the report. Changes are made in your project and described afterwards so you can see exactly what moved.
Apps from Lovable, Bolt, v0, Cursor, Replit and similar, particularly those using Supabase, Firebase, Stripe or a hosted database. Other stacks are fine if the code is readable.
Tell us what is happening and we will come back with a fixed quote and a timeline, usually within one business day.
Get in touchCheck an AI-built app for exposed keys, open database tables and weak sign-in. Plain-language report first, fixes only after you approve. Australia-wide.
Get in touchEvery CloudyWP project runs the same way, whether it is a one-page site or a store with a thousand SKUs. Here is exactly what happens.
A single scoping call, then a written plan: what gets built, what it costs, and when it ships. No discovery-phase invoices, no moving targets.
48 hrs to your quote
Custom WordPress or Shopify on clean code you own outright. Every build ships fast, passes Core Web Vitals, and is handed over documented.
95/100 average PageSpeed
Your site talks to the tools you already run: CRM, invoicing, email, stock. The repetitive admin stops being someone's job and starts running itself.
15 hrs saved every week
