Maurício Ferreira
Founder · 20+ years in production
Designed, scaled and rescued software in production for 20+ years: at the BBC and, for ten years, at Visian Systems, a UK software house. Reads every request for a check.
Vibe code audit Vibe code auditA named senior analyst checks your live app. We fix what could hurt your users at a fixed price, and check every fix again, or refund it.
Every review ends with a scorecard: a verdict you can forward, and your app scored out of 5 in eleven areas by a senior analyst. With it come the findings ranked and priced, a prompt for your AI tool for each, a rules file, the call, and a second check after the fixes.
Verdict
Ready with conditions
Ready · Ready with conditions · Not yet
Average across
eleven areas
Fix first: Security, Database, Compliance and privacy, Verification and testing, Observability, Documentation
Scored by a senior analyst against the same criteria for every app, not by a tool. This example is an illustration, not a real client’s app. Compliance and privacy covers the basics; it isn’t legal advice or a certificate.
What arrives, and when
Day 0
An NDA and a data agreement first, then read access to your code, database and hosting.
Within 5 working days
Every finding ranked, worst first, with a fixed price for each fix, and your scorecard.
After the report
With the analyst who reviewed your app, to agree what to fix first.
André DerraikSenior analyst · 30+ years
1 to 3 weeks
Only the fixes you choose, on a copy, live only with your approval. Each one checked again.
If you go ahead with fixes
30 days later
We look again, to make sure the fixes held.
The check covers what any visitor’s browser can see. The review covers all ten.
Free: the checklist as a printable PDF. Get it by email
We look only with your permission. Before any access we sign an NDA and a data agreement, and we remove our access and delete our working copies within 30 days of the report call. A review is not a penetration test or a compliance certificate; it’s a plain-English look at the things that most often go wrong. No review can guarantee an app will never be breached.
Every finding in a review is set out the same way, so you can see what it means and what it costs to fix. These three are illustrations, not real clients’ apps.
Signed by the analyst who found itAndré Derraik, senior analyst · checked by Maurício Ferreira
In Supabase, turn on row-level security for the orders table. Add policies so a signed-in user can read, update and delete only rows where user_id equals auth.uid(). Don’t change any other table. Then show me the policies and how to test them signed in as two different users.
Our Stripe secret key is in code the browser loads. Remove it from every front-end file. Create a server function that makes the Stripe calls with an environment variable named STRIPE_SECRET_KEY, and call that function from the front end instead. List every file you changed. I’ll replace the key in Stripe myself.
Our Stripe webhook doesn’t check signatures. Verify every incoming event with the signing secret in STRIPE_WEBHOOK_SECRET and reject any that fail. Handle payment_intent.payment_failed, charge.refunded and customer.subscription.deleted. Then show me how to test each one with the Stripe CLI.
This finding is an illustration, written the way a real one is.
create table orders ( id uuid primary key, customer_id uuid references auth.users, address text, total numeric); -- row-level security is off:-- anyone with the public key reads every rowcreate table orders ( id uuid primary key, customer_id uuid references auth.users, address text, total numeric); alter table orders enable row level security;create policy "Customers read their own orders" on orders for select using (auth.uid() = customer_id);import Stripe from 'stripe'; // this file is sent to every visitor's browserconst stripe = new Stripe('sk_live_51H…'); export async function refund(chargeId: string) { return stripe.refunds.create({ charge: chargeId });}import Stripe from 'npm:stripe'; // runs on the server; the key never reaches the browserconst stripe = new Stripe(Deno.env.get('STRIPE_SECRET_KEY')!); Deno.serve(async (req) => { const { chargeId } = await req.json(); // check the signed-in user may refund this charge const refund = await stripe.refunds.create({ charge: chargeId }); return Response.json(refund);});Deno.serve(async (req) => { const event = await req.json(); // trusts any request if (event.type === 'checkout.session.completed') { await markPaid(event.data.object.id); } return new Response('ok');});Deno.serve(async (req) => { const body = await req.text(); const event = await stripe.webhooks.constructEventAsync( body, req.headers.get('stripe-signature')!, Deno.env.get('STRIPE_WEBHOOK_SECRET')!); // fails if not from Stripe if (event.type === 'checkout.session.completed') { await markPaid(event.data.object.id); } return new Response('ok');});Fix, refactor or rebuild?
Usually fix. The review says which each problem needs, and why, before you spend anything.
WhenA specific hole: a missing database rule, a key in the page code, a payment message nobody checks. Most findings are this.
EffortHours per item, each at a fixed price set in the review.
WhenThe same problem repeats across the app, or one part is too tangled to fix safely on its own.
EffortLonger than a fix, and still a fixed price set in the review.
WhenOnly where rebuilding a part would cost less than fixing it. It’s rare, and the review says so plainly.
EffortQuoted separately, and only if you ask for it.
Keep using your tool’s scan. Here’s what each option covers.
Coverage of the 8 things that go wrong most
| Your tool’s scan | An automated scanner | Our review | |
|---|---|---|---|
| Open dataDatabase rules switched off | Yes | Yes | Yes |
| Leaked keysSecrets in your code | Yes | Yes | Yes |
| PaymentsStripe’s messages and refunds | Partly | No | Yes |
| Running costsLimits and calls that grow with users | No | No | Yes |
| BackupsOn, and possible to restore | No | No | Yes |
| MonitoringKnowing before your users do | No | No | Yes |
| A person reads itRanked in plain English | No | No | Yes |
| The fixDone, then checked again | Partly | No | Yes |
Based on the tools’ own documentation, October 2026. Lovable and Replit say their scans don’t replace a full security review.
Not a bot, and not a junior reading a scanner’s output. Every check and review is done by a senior analyst you can name, look up and talk to, and the same person reviews your app, writes the report and takes the call.
Founder · 20+ years in production
Designed, scaled and rescued software in production for 20+ years: at the BBC and, for ten years, at Visian Systems, a UK software house. Reads every request for a check.
Senior analyst · Principal Software Engineer · 30+ years
Python and Django, Go, Java and Spring, C and C++, and Node.js.
Senior analyst · Principal Software Engineer · 10+ years
Python, PHP, Ruby on Rails, Angular and Flutter.
Senior analyst · Sr. Software Engineer & Architect · 16+ years
C# and .NET, Java, React and Angular, SQL Server and Azure.
Leandro MonteiroOperations & Data Analyst
Gabriel MoraesSoftware Engineer & Product Owner
Douglas CollarTech Lead & Product Owner
Giovani TadeiProject Manager
Kelvyn TellesDjango & Fullstack Developer
Luiz MainartBackend Software Engineer
Cícero JúniorData Engineer
Abner PereiraSoftware Engineer
Gustavo RizzoSr. Backend Developer
Fabricio SantosSr. Backend DeveloperThe people behind the reviews
From the first check to the fix: meet the people who review and repair AI-built apps at Visian Systems.
Different stacks.Same standard.One team.
35 people at Visian Systems.
Reviewed by people.Fixed by the same team.
From the first check to the fix.
You decide at each step. Nothing is sold before we’ve seen the problem, and every fix is checked again, or refunded.
Our guarantee: if an item on the agreed list fails our second check, we fix it within 10 working days or refund that item’s price.
This covers the code as we handed it over, not changes made after handover, and our total liability is capped at the fees you paid.
We don’t promise income. We promise things you can check: a safer app, lower running costs, fewer surprises.
They’re automated tools, and good at what they do: Snyk looks mostly at the packages your app depends on, SonarQube at code quality, and CodeRabbit reviews each change before it’s merged. Keep using them if you do. A review adds a senior analyst who looks at how your live app behaves, from database rules and payments to backups and costs, ranks what matters for your business in plain English, and fixes it at a fixed price.
Yes. You keep your app and your tools. The review comes with a rules file your AI tool reads before each change, so it follows what the review found, and every fix adds a note on what changed, so the tool doesn’t undo it.
The check is in your inbox within one working day of your request. A review takes five working days from the day access is set up, and we’ll give you a start date when you ask for it.
A verdict you can forward (ready, ready with conditions, or not yet) with the three reasons behind it, then eleven areas, each scored out of 5 by a senior analyst: security, database, compliance and privacy, architecture and scalability, code quality, verification and testing, DevOps and infrastructure, observability, documentation, vendor independence, and design and user experience. Each score comes with the reason and what would raise it. It’s part of the £750 review.
Yes, if your app is live and people pay for it, or soon will; you built it with Lovable, Bolt, Replit, v0, Cursor, Claude Code or something like them; and you want to keep your app and your tools. It isn’t for you if you’re still looking for an idea, want a new app built from scratch, or want guaranteed income: we make your app safer and cheaper to run, and don’t promise what it will earn.
The first check is £49. The full review is £750, with a fixed price for each fix it finds; most fixes come to £3,000 to £6,000 in total, and the £750 comes off if you go ahead within 30 days.
Lovable can run a production app, and it scans for common problems when you publish. Its own documentation says that scan doesn’t replace a full security review. What matters is how your app was set up: its database rules, keys, payments and backups.
Yes, when it’s set up properly. The usual problem isn’t Supabase but a table left without row-level security, or a secret key placed where the browser can see it.
It’s a Supabase warning that a table has no row-level security, so anyone with your app’s public key may be able to read or change it. On a table with customers’ data, it’s usually the first thing to fix.
Keep using the scan. It catches open data and leaked keys. It doesn’t look at payments, running costs, backups or monitoring, or see your app the way a stranger does. That is where we look.
Usually fix it. Most apps need a short list of specific fixes, done in your app, with your tools. If a rebuild really would be cheaper, the review says so.
No. Everything is in plain English, with what to tell your AI tool if you’d rather make a fix yourself.
Lovable, Bolt, Replit, v0, Cursor, Claude Code and tools like them, plus the services they run on, such as Supabase, Firebase, Vercel and Stripe. See the full list of tools we review.
None for the check. For the review, read access to your code, database and hosting, after an NDA and a data agreement. We remove our access and delete our working copies within 30 days of the report call.
Only what any visitor’s browser receives, and only after you’ve said yes.
The check reaches you within one working day, the review within five working days of access being set up, and a fix takes one to three weeks, depending on the list.
We fix it within 10 working days or refund that item’s price. This covers the code as we handed it over, not changes made after handover.
The review checks what personal data your app collects, where it’s kept and who can see it, which is most of what UK GDPR asks of a small app. We’re engineers, not lawyers, so we’ll tell you if something needs legal advice.
No. A review is a plain-English look at the things that most often go wrong in apps built with AI. If you need a penetration test or a certificate, we’ll say so.
Start with a check of your app: one page, three findings, yours to keep. Tell us about your app.
Your request goes to Maurício FerreiraYou’ll hear back from a person, not an autoresponder, within one working day.
After your fix, stay on board: AI Ship Captains is also a community for founders who run apps built with AI. It’s closed to new members for now, but you can register interest.
Illustrative · a booking app built with Lovable, Supabase and Stripe
Each area scored out of 5 by a senior analyst. Open one to see what we looked at, what we found and what would raise it.
5 Strong · 4 Sound · 3 Fair · 2 Weak · 1 At risk