AI app builders can take an idea to a live app in a weekend. They build what you ask for. They don't always build what you didn't think to ask for: who can read each table, where the secret keys live, and whether the server checks who is asking.
Axieo Guard is our security audit for these apps. We audit apps built with Lovable, Bolt.new, Replit, v0, Base44 and Firebase Studio, and web apps written with AI coding tools such as Cursor, Windsurf and Claude Code.
1. The problems we see most often
- Database rules that are too open. Supabase uses Row Level Security, Firebase uses Security Rules, and other back ends check access in server code. If a rule is missing or too broad, one user can read or change another user's data.
- Secret keys in the browser. Keys for payments, AI services or database admin access end up in the front-end code, where anyone can copy them.
- Admin pages that are only hidden. Hiding a button doesn't protect a page. The server and the database have to check who is asking.
- Payments that can be skipped. If paid features are unlocked in the browser, or payment events aren't verified, people can get them without paying.
2. What the 25 checks cover
Every app gets the same 25-point checklist, applied to its own database, login and hosting:
- Secrets and keys (3 checks), including leaked secrets in git history
- Database and data access (5), so users can read and change only their own rows
- Login and permissions (4), with admin pages and roles checked on the server
- Server functions and APIs (4), including rate limits on sign-up, login and AI calls
- Payments (2): Stripe webhook signatures and paid features enforced on the server
- Front end and hosting (3): security headers and known-vulnerable packages
- Reliability and privacy (4): backups, a tested restore and privacy basics for PIPEDA
3. How it works
- 01Free mini scan. Send us your app's address. We run five high-impact checks, including exposed keys and open database tables, and email you a plain-English summary within two business days. No payment details needed.
- 02Written authorization. Before any testing, you confirm you own the app or may authorize testing. We're happy to sign a mutual NDA first.
- 03The audit. We run automated checks, then review the code and settings by hand. Testing is read-only. If we find something critical, we stop testing that item and call you the same business day. A full audit usually takes three to five business days after we have access.
- 04The report and a 30-minute review call. We walk you through the findings and answer your questions.
- 05Your team makes the changes, then we re-test once within 30 days, included in the price, to confirm each fix worked.
4. What's in the report
A risk score from 0 to 100 and a short summary written for non-technical readers. Then, for every finding:
- its severity and the evidence we found
- why it matters, in business terms
- our recommended fix, step by step for your stack
- a suggested prompt, written for your app, that your team can use in your AI builder
- a rough effort estimate and the order to work in
- how to check your fix yourself
The report also lists what's already working well, so you know what not to touch.
5. We recommend, you decide
Axieo Guard is advisory. We never change your code, data or settings, and we never ask for write access. An auditor who makes the changes would end up checking their own work, so we keep the two apart: we assess, your team or a developer you choose makes the changes, and we verify.
The suggested prompts are recommendations. Review what your builder proposes before you apply it, because AI tools can give different results each time. That's one reason the re-test is included.
6. Prices
- Free Mini Scan: free
- Security Audit, Standard: CA$750. For most apps: built on Supabase (as Lovable and Bolt.new apps usually are), with one type of user and no payments.
- Security Audit, Advanced: CA$1,500. For apps not built on Supabase, with several user roles, or with payments. Same 25 checks and deliverables, with about twice the hands-on testing.
- Extra re-test: CA$350, if you want another one after the included re-test
- Care plans: CA$199, CA$399 or CA$699 a month, to keep checking your app as it changes
Prices are in Canadian dollars. Not sure which audit fits? Ask us after your free mini scan and we'll tell you before you pay.
What no audit can promise
No honest provider can guarantee an app is 100% secure. We check a defined list of the problems that most often affect AI-built apps, show you the evidence, recommend how to fix each one, and re-test after your fixes. Your app keeps changing with every new prompt to your builder, which is why the care plans re-check it every month.
Start with a free mini scan, or read the full details on the Axieo Guard page.