Preflight for AI-built apps
Check your app before the internet does.
Bots start probing new apps within hours of launch, looking for exposed keys, open databases and unguarded payment hooks. Apps built fast with AI tools often ship with exactly those gaps. Find them first.
Free check: about 15 minutes, no login, nothing to install, nothing of yours shared.
The free check
Ten things to test before you launch.
Work through them yourself, or copy the whole list and paste it into Claude or ChatGPT along with your code, and ask it to check each one.
- 01
Exposed secrets
Search your client-side JavaScript and git history for API keys, database URLs or passwords.
Fix: move secrets to server-side environment variables, and rotate any key that was ever public.
- 02
Open database rules
Try reading or writing a record through your app's API without logging in. If it works, your rules are wide open.
Fix: require sign-in and an ownership check on every read and write rule.
- 03
Unverified payment webhooks
If you take payments, check that your webhook handler verifies the provider's signature (e.g. Stripe's
stripe-signature) before trusting an event.Fix: verify the signature on every webhook and reject anything that fails.
- 04
Cross-user data leaks
Log in as one test user, note an ID (an order, a profile, a file), then try that ID as a different user. If you see the first user's data, it leaks.
Fix: check ownership on the server for every request. Never trust an ID from the browser alone.
- 05
Unbounded cost
Check whether your AI calls, database queries or auto-scaling have any rate limit or spending cap. One bad actor can turn into a real bill fast.
Fix: rate-limit per user and IP, and set a hard spending ceiling with alerts.
- 06
Legal pages
Make sure you have a privacy policy, terms of service and, if you sell anything, a refund policy, and that they describe what your app really does.
Fix: write pages that match your actual data handling and refund practice.
- 07
Auth and sessions
Check that reset links expire, sessions time out, and no admin or internal route is reachable without logging in.
Fix: expire tokens, put auth on every non-public route, and test it logged out.
- 08
HTTPS and security headers
Confirm your site forces HTTPS and sets basic security headers. You can check free at securityheaders.com.
Fix: redirect HTTP to HTTPS and add the headers your framework makes easy.
- 09
Accessibility basics
Images have alt text, text has enough contrast, and you can reach every control with just the Tab key.
Fix: add alt text, fix low-contrast colors, and make the focus order make sense.
- 10
Speed basics
Run your homepage through Google's free PageSpeed Insights. Look for oversized images and anything blocking the first paint.
Fix: compress images, defer non-critical scripts, and cache what doesn't change per visitor.
Want a second set of eyes?
Two ways we can help.
Found something you can't fix, or not sure you checked it right? Pick one. Nothing is reviewed until you confirm in writing that you own the app or are authorized to have it reviewed.
Launch-Readiness Report
- All 10 checks, plus a few more we find along the way
- Database test: can strangers read your Supabase or Firebase data without logging in? (We count, never download.)
- Plain-English findings, each with the exact fix
- Ranked: fix-now, review, pass
- Delivered within 48 hours
We fix it for you
- We fix the findings from your report directly
- Scope confirmed with you before any work starts
- Secrets rotated, rules locked down, webhooks verified
- A short write-up of everything changed
How it works
Three steps, no meetings.
Order and authorize
Check out, give us your app's address, and confirm you own it or are authorized to have it reviewed.
We run the checks
We test your app against the full checklist, from the outside and, if you share it, from the code.
You get the report
Every finding, ranked, with the fix, in plain English, within 48 hours.
Questions
Before you buy.
Who does the review?
Feenmile is an AI-first studio. An AI agent runs the checks and writes your report against this checklist, so it's fast and affordable. If something needs judgment we can't give with confidence, the report says so plainly instead of guessing.
How do you test my database without touching my data?
If your app uses Supabase or Firebase from the browser, we use the same public key your site already ships to ask the database one question per table: how many rows would you show a stranger? The answer is a number. We never download, store or change a single row.
Do you need my code?
No. The report works from your live app alone. Sharing read-only access to the code lets us check more, like secrets in git history and server-side rules, but it's optional.
Will you test apps I don't own?
No. We only ever review an app you own or are authorized in writing to have reviewed. We never scan anything uninvited.
What if you find nothing?
Then you get a report saying so, with what we checked. That's useful proof before you launch or raise money.
Do you keep or share what you find?
No. Findings go to you only. We don't publish, sell or reuse anything about your app.