Launch Review Pricing

For founders who built their app with Cursor, Lovable, Bolt, Claude or a similar AI tool

An expert check of your app's code, before real customers use it.

Your app works. But code written by AI can hide problems that only show up once real people sign up and pay: one customer able to see another customer's data, purchases that are never properly verified, secret keys left where anyone can find them. Problems like these don't cause a visible crash, so they can go unnoticed until a customer, or an attacker, finds them first.

Launch Review is a fixed-price review of your code. I read it, find those problems, and send you a written report that explains each one in plain language, how serious it is, and how to fix it.

  1. 1
    Pay online
    $300 or $500, fixed. No call needed.
  2. 2
    Send your code
    One file, made with one command. Step-by-step instructions provided.
  3. 3
    Get your report
    In 3–5 business days: what's wrong, how serious, how to fix it.
See pricing For web apps written in TypeScript, JavaScript or Python.

What gets checked

Six questions every app that has customers should be able to answer "yes, we're safe" to. The technical names are in brackets for whoever builds the fixes.

Secret keys

Are the passwords and API keys that unlock your database, payments or email sitting in your code, in its old versions, or in the pages sent to visitors' browsers?

Customer accounts

Can one customer see, change or take over another customer's data or account? (authentication and authorization)

Payments

Does your app confirm what a customer actually paid for before giving it to them? Does it stay correct when payment notifications fail or arrive twice? (checkout validation, webhooks)

Database access

Do your database's rules stop people reading or changing data that isn't theirs? (row-level security, grants)

Harmful input

Can someone type or paste something that runs on your site, or tricks your app's AI features into misbehaving? (cross-site scripting, prompt injection)

Third-party code

Does your app depend on packages with known security holes, and does that actually affect how you use them? (dependency advisories)

How the review works

  1. Two separate reviews of your code, each done independently of the other.
  2. Compared point by point. Where the two disagree, the report says which one is right and why. That comparison is what catches problems a single review misses (see the example below).
  3. Evidence for every problem: exactly where it is in your code, whether it was confirmed by actually triggering it in a safe test setup (never on your live app) or found by reading, and how to fix it.
  4. A list of what was not checked. So nobody mistakes "not looked at" for "safe". There's no percentage "security score": it would suggest a completeness no review can honestly promise.

You receive

  • A written report, most serious problems first
  • For each one: how serious, where it is, how to fix it
  • What was checked and found sound, and what wasn't checked
  • A fixed-price quote to fix everything for you (Fix Sprint), if you want one

The review only reads your code. Nothing in it is changed.

Proof: I ran it on my own product first

Before offering this to anyone, I ran the full review on a paid web app I built and run myself. It checks businesses' payment accounts for problems, takes card payments and monthly subscriptions, sends email, and runs automatic background jobs. If your app takes payments or stores customer data, it has similar pieces.

3serious
2moderate
5minor
  • The most serious problem was only caught because the two reviews disagreed. Anyone could start a free trial using an existing subscriber's email address, and the app would hand them that subscriber's account. They could then connect their own payment account in its place, and the real subscriber would keep paying for a service that had quietly stopped working for them. One review saw only half of this and rated it minor. The other traced it to the start, and together they showed it was the worst problem in the app.
  • Every serious and moderate problem was then fixed and released. Each code fix came with automated tests, and I put the old code back to confirm those tests catch the original bug. So it can't quietly return.
  • The second review caught my own first fix being incomplete. Subscribers whose payments had lapsed were still exposed. It was fixed again before release. That's why every review is done twice.

The kind of thing it finds

Three real problems from that same app, found while I was running it.

It said "done". Nothing had been saved.

The app emailed a customer that it had found 4 issues, but their report page showed none. The database had rejected every result, nothing in the code checked for that, and the job still marked itself complete. Now every number a customer sees is read back from what was actually saved, and an automated test fails if the old bug ever returns.

Worked in every test. Did nothing for real customers.

One of the app's main features passed every test, because the tests used my own full-access key. Real customers grant limited access, which hides one piece of data the feature needed, and the code skipped those records without any error. Measured on the same data: 18 problems found with full access, only 14 with a real customer's access.

The visitor counter counted bots as people.

My home-built tracker reported 6 real visitors in its first week. Looking closer: two "visitors" arrived at the exact same microsecond, and one claimed a browser version that has never existed. At most 1 was a real person. It now records the reason behind every verdict, so mistakes like this are visible.

Pricing

Fixed prices. Pick the tier that matches your app; the criteria are things you can check yourself.

Starter

$300

  • One app, one deploy target
  • Login, plus at most one outside service (for example, Supabase only)
  • Does not take payments yet
Buy Starter

Standard

$500

  • Takes payments (Stripe or similar), or
  • Two or more outside services, or
  • Background jobs or webhooks
Buy Standard

Bigger

Quote

  • Several services, mobile plus backend, or multi-tenant
  • Not sure which tier fits
  • A fixed price, in writing
Get a written quote

Picked the wrong tier? If your app turns out to be bigger, I'll email you the upgrade price or a full refund, your choice, before any work starts.

What happens after you pay

  1. You send your code as a git bundle: one file with the full history, made by one command (the exact steps are on the next page). No account invites, and nothing can be pushed to your repository.
  2. You answer five short questions by email: what the app does, what it connects to, your launch date, what worries you, and anything that's off limits.
  3. The clock starts when the bundle and answers arrive. The report lands in 3–5 business days.
  4. Questions about the report? Reply by email. No calls needed.

Then, if you want it: Fix Sprint

A fixed price, quoted in the report, typically $2,000–5,000 and capped at 2–3 weeks. Fixes come back as commits you review and merge, one per finding, each with a test that fails on the old code and passes on the new, then a re-scan with a before/after. Accept by paying the invoice. No obligation.

Questions

Do you need my passwords, API keys or production database?

No. A git bundle of your repository is all that's needed, and uncommitted files such as .env are never in it. Never send production secrets; if the review finds any in your code, the report tells you which to rotate.

Will you change my code?

Not during the review. It's read-only. Code changes happen only in a Fix Sprint, if you choose one.

Which languages and frameworks?

Web apps written in TypeScript/JavaScript (Next.js, React, Node, Express) or Python (FastAPI, Flask, Django), with the usual pieces around them: Supabase or Postgres, Stripe, Vercel and similar hosts. I build and run production apps in both languages myself. Other languages (Ruby, PHP, Go) or native mobile apps: ask for a written quote first and I'll tell you honestly whether it's a fit.

What about confidentiality?

Your code is used only for your review, never published or reused, and the bundle is deleted after delivery. Findings are shared only with you.

Is this a penetration test or a compliance audit?

No. It is a code review: it reads and reproduces against your code, it does not attack your live systems, and it does not certify compliance (SOC 2, PCI and so on).