Your app works.
Who else can get in?
We test apps built with Lovable, Bolt, Replit, Cursor or Claude Code the way someone trying to get in without permission would.
It is a fixed-price vibe code audit by developers who also build with AI, and it tells you what to fix first and how.
Four moments when an AI-built app stops being a prototype and becomes a liability.
It works, people sign up and pay, and nobody besides the AI tool has read the code.
It asks about access control, encryption and backups, and today the honest answer to several is "I don't know."
The investor's technical due diligence will open the code, and it pays to arrive with the serious issues already fixed.
It already touches customer or company data, and IT found out once it was in use.
And the studies that measured its security point the same way.
42% of the code developers commit is already written by AI, by their own estimate. Only 48% say they always check it before committing.
Sonar, State of Code Developer Survey 2026, 1,100+ developers, January 2026
45% of test tasks ended with an OWASP Top 10 vulnerability when an AI model wrote the code. A year later, the figure had barely moved.
Veracode, GenAI Code Security Report 2025 and 2026 (100+ models, 80 tasks)
More confident and with less secure code: that is how people who coded with an AI assistant came out of a Stanford experiment, compared with those who did not use one.
Perry, Srivastava, Kumar and Boneh, ACM CCS 2023 (47 participants)
Answer with what you know today. A "don't know" counts the same as a "no": it is something nobody has verified.
Cases documented by security researchers in apps built on AI platforms.
Escape scanned 5,600 vibe-coded apps and counted, at a minimum, more than 2,000 vulnerabilities and 175 cases of exposed personal data, including medical records and bank account numbers.
Out of 1,645 projects reviewed, 170 let anyone read emails, API keys and personal data without signing in, and some also allowed writes, because their tables lacked adequate access rules. Lovable disputes the report and says that setup is up to whoever builds the app.
Its founder had posted that they did not write one line of code. The Supabase key lived in the browser JavaScript and the tables had no RLS, so anyone could read and write.
In the US, the FTC treats a failure to take reasonable security measures as an unfair practice under Section 5 of the FTC Act, and in a December 2025 proposed order it pointed to code that shipped without adequate testing.
Three ways to review the security of an app and what to expect from each.
| Automated scanner | Formal pentest or certified audit | Fyware diagnostic | |
|---|---|---|---|
| What it covers | Known patterns in the code and dependencies | The scope set by the contract or the standard | The whole app: database, access, keys, payments and AI features |
| Seeing another account's data | Rarely detects it | Tests it if it is in scope | Tested by hand with two test accounts |
| What you get | A long list, with false positives | A formal report and, for an audit, the certification | Confirmed findings, with evidence and priority |
| How to fix | Generic advice | Recommendations per finding | The prompt for your AI tool and estimated hours |
| When it fits | Always, on every change | When a customer or a regulator asks for certification | Before launch, a fundraise or signing a big customer |
| Cost | Free or low cost | The highest of the three | Fixed price, in writing before we start |
The next step
AI wrote the code. Now have it reviewed by someone who did not write it.
They come from what security researchers document and from what we have seen fail in AI-written code, our own included. Each point is tested in your app.
The twelve points map to the OWASP Top 10:2025, which already tracks inappropriate trust in AI-generated code, and to the OWASP Top 10 for LLM Applications.
We work with read-only permissions, on the environment you choose.
We sign an NDA. You give us read access to the repository, the staging URL and two test accounts with different roles.
Our tools go through the code, the dependencies, the configuration and the database rules.
A developer tests the twelve points with both accounts, the way someone trying to get where they should not would.
You get the report and we go through it with you on a call, finding by finding and in order of priority.
One person and read access; we handle the rest.
To give us access and join the results walkthrough. No IT department needed.
We work with read access to the code and with test accounts that you create and remove when we are done.
A fixed price based on the size of the app: screens, user types and integrations such as payments or AI.
How it is contracted. The diagnostic is quoted on its own. If you then want us to fix the findings, that part is quoted separately using the hours already in the report. The diagnostic does not replace a certified audit or a formal pentest; if a customer asks you for one, you arrive with the serious issues already fixed.
We sign our standard NDA, or yours, before any access.
We make no changes to your repository or your database.
We test on staging. If the app only lives in production, we agree with you on what gets tested and when.
When we deliver, we ask you to revoke access, and we delete our copy of the code when you request it in writing.
More on how Fyware handles client information in Security and Data Ownership.
No. It is a technical review by developers, with our own tools and manual testing, and it does not issue certifications or attestations. If a customer or a regulator asks you for a certification, a SOC 2 audit or a formal pentest, you need an accredited auditor; the diagnostic helps you reach that audit with the serious issues already fixed.
It has a fixed price that depends on the size of the app: how many screens and user types it has and which integrations it uses, such as payments or AI. You get it in writing, with the delivery date, before we start. Fixing the findings, if you want us to do it, is quoted separately.
No. We work with read access to the repository, the staging URL and two test accounts that you create. If the app only lives in production, we agree with you on what gets tested and when.
More questions
Tell us what your app does and which tool it was built with. We reply with the scope of the diagnostic, the delivery date and the fixed price.
Tom Klukowski, Fyware Partner · Valcre Marketing We reply in under 24 business hours, with scope, timeline and investment range.In the meeting we look at the size of your app, what access we need and what the diagnostic includes. And if you need to sell it internally, this page is your presentation: share it with your team.
