We look at your live app from the outside, the way a stranger would. You get a plain-English report of what's exposed, plus fixes you can paste straight into your AI builder. Or we fix it for you.
Read-only checks. Only apps you own. Report within 24 hours on UK business days.
Works with apps built on:
AI app builders are great at getting something working. They're less reliable at the boring bits that keep your data private, like database permissions and hidden keys.
A key left in your published code or a database table anyone can read can be spotted by anyone who opens their browser's developer tools. You won't know until it's too late.
Free scanners give you a list of jargon. Human audits typically start at several hundred pounds. We sit in between: a clear answer and a real fix, at a fair price.
Everything is read-only and non-invasive. We don't attack, overload or change your app.
Honest limits: this is not a penetration test and we can't guarantee your app is secure. We check for the common problems we see in apps built with AI, and we tell you clearly what we couldn't check.
Pick a plan, pay securely through Stripe, give us your app's web address and confirm you own it.
We run our read-only checks against your live app. Your report arrives by email within 24 hours on UK business days.
Paste the fix prompts into your AI builder, or let us make the fixes with Checked & Fixed. Then we check again to confirm.
One-off payments in GBP. No subscription, no account to set up.
£79 one-off
You fix it, with clear instructions.
£149 one-off
We fix it, and you stay in control.
You must own or control the app. We only check apps you own or have permission to manage, and you confirm this at checkout. If we can't confirm ownership, we won't run the check and we'll refund you.
Payments are handled by Stripe. By buying you agree to our terms.
Not sure yet? Send us your app's address and we'll email you three quick findings from a light, read-only look at your live site. No payment, no account.
We only use your email to send your findings and, if you ask, to follow up. See our privacy notice.
No. We run read-only, non-invasive checks on your live app from the outside, the way a curious stranger would look at it. We don't try to break in, overload your app or change anything. A full penetration test is a bigger, more expensive job, and we'll tell you if we think you need one.
No, and nobody honest can. We check for the most common problems we see in apps built with AI tools and tell you clearly what we found and what we couldn't check. Fixing those problems makes your app much harder to misuse, but it isn't a guarantee.
No. The report is written in plain English with a simple traffic-light summary. For each problem you get a copy-paste prompt you can give to Lovable, Bolt, Replit, Cursor or v0 to fix it. If you'd rather not touch it at all, choose Checked & Fixed.
No. We only check apps you own or control, and you have to confirm that before we start. If we have any doubt about ownership, we won't run the check and we'll refund you.
Your report arrives by email within 24 hours on UK business days (Monday to Friday, excluding bank holidays). Checked & Fixed takes longer because you approve the fixes before they ship. We'll keep you updated by email.
Once you've made the fixes, reply to your report email and we'll run the same checks again and send you an updated report. One re-check is included with both plans.
After you pay, we email you to arrange access to your app's code, usually by inviting us to its GitHub repository. We prepare the fixes and send you a plain-English summary of every change. Nothing ships until it's approved. High-risk changes, such as anything touching payments, user data or logins in a way that could lock people out, are never applied automatically; you get step-by-step instructions instead.
Built-in scans are useful and you should use them. They look at your project from the inside. We look at your live site from the outside, the way a stranger sees it, which can catch things like keys in your published code, exposed files and missing headers.
As little as possible: your email, your app's address and the findings from your check. We never try to read your users' data. If we come across any while checking, for example because a database is open, we stop, note that it's exposed and don't keep a copy. See our privacy notice for details.
Anything else? Email hello@checkedandfixed.com.