Change one number in the URL and you're looking at someone else's order.
Name, address, phone, card. It's called broken access control, and it's the number one risk on the OWASP Top 10. The app checks that you're logged in, but never checks that the data is yours. A simple script can then pull every customer you have.
Apps built quickly, or mostly with AI coding tools, are where we see this most. The demo works, so nobody looks at what happens when someone asks for data that isn't theirs. Our audit tests your app or website the way an attacker would, and tells you exactly what to fix.
Security audits
What we test
Access control
Can one user read or change another user's orders, files or account? We try, on every endpoint and every database table, including row-level security on Supabase and Firebase.
Exposed keys and secrets
API keys for OpenAI, Stripe or your database shipped inside the app or the website's code, where anyone can copy them and run up your bill.
Logins and sessions
Password reset, magic links, social login and admin pages. The places where a small mistake lets someone in as someone else.
AI features
Chatbots and AI tools that can be talked into revealing their instructions, other users' data or anything they're connected to.
GDPR and customer data
What personal data you collect, where it's stored, who can reach it and how long you keep it. The questions you'll be asked if something ever leaks.
Our approach
A leak isn't just a bug
When customer data leaks, it becomes a legal problem. Under GDPR that means:
- Fines of up to €20M or 4% of global yearly turnover
- 72 hours to report the breach to the authorities
- Customers who can claim compensation
So we test before launch, or right now if you're already live. You get a written report that ranks every issue by how bad it is and how to fix it, in plain language your developer, or ours, can act on.
We build and run our own apps, so we know where things break when a product is shipped fast. We check those places first.
Example
How an audit runs
- 1
Scope
Which app, website and APIs are in, and a test account or two.
- 2
Test
We try to reach data and features we shouldn't, the way an attacker would.
- 3
Report
Every finding, how serious it is and the exact fix.
- 4
Fix and retest
We fix it with you or your team, then check the fixes hold.
We only test systems you own or have permission to test, and nothing touches your real customers' data.
FAQ
Questions we get asked
Our app was built with AI tools. Is that a problem?
Not on its own. AI tools write working code quickly, but they rarely add the checks that stop one user from reading another user's data, and they often put API keys where anyone can see them. Those are the first things we look at.
How long does an audit take?
Most apps and websites take a few days to a week, depending on how many features, user roles and APIs they have. You'll get a fixed price and a date before we start.
Can you fix what you find?
Yes. The report is written so any developer can fix the issues, and if you'd like, we fix them for you and retest afterwards.
Is this a penetration test?
It covers the same ground for a typical app or SaaS: access control, authentication, exposed secrets and data handling. If you need a formal certification for a client or an insurer, tell us and we'll say whether our audit fits.
Other things we do
- AI app developmentAI apps for iOS, Android and the web, built and launched.
- AI integrationAI connected to the email, CRM and spreadsheets you already use.
- Motion designLaunch videos, App Store previews and product animations for apps and SaaS.
- Custom softwareWeb apps, portals, internal tools and SaaS built around your process.
- Process automationOne system in place of paper, spreadsheets and group chats.
Is your app leaking data?
Send us a link to your app or website and a few lines about what it does. We'll reply with what we'd test and what it would cost.
The first consultation is free.