For founders shipping with Lovable, Bolt, Cursor & Replit
AI tools write working apps, not always safe ones. I check yours by hand for exposed keys, open databases, unprotected API routes and AI features that can be talked into leaking data. You get plain-English findings and fixes you can paste straight into your AI coding tool.
Joshua Bluestine A developer who tests the apps founders ship
01 / Credentials & research
You work directly with the person testing your app. No sales team, no hand-offs.
Public research and lab work you can check for yourself.
Founder · AI & application security researcher
I’m a developer who ships products too, so I test the way your app is actually built: follow the data, check what each user and AI feature can reach, and write fixes you can apply without a security background.
LLM & agent security · API & backend integrations · Python automation
View GitHub profileCVE-2026-49950
I reported unauthenticated access to actor control functions. The maintainers included that report in their combined advisory and credit me as a reporter.
Read the maintainer advisoryAn unauthenticated peer reaching an exposed actor-pool port could request configuration and topology information or stop a pool. Application login did not protect this separate internal transport.
Xoscar 0.12.0 introduced opt-in actor-transport authentication with XOSCAR_AUTH_KEY. A strong, nonempty key must be configured on communicating processes, and actor ports must be restricted to intended peers. An unset or empty key retains unauthenticated behavior; upgrading alone does not enable the protection.
The advisory combines multiple reports. Its critical rating and title concern a separate deserialization issue. My credited contribution is the related unauthenticated control-plane exposure.
Read the full research note →These examples come from intentionally vulnerable applications, not customer engagements. They show how I connect a finding to its impact and a practical fix.
What I check
Your app works in the demo. The question is what a curious user, or an attacker with browser dev tools, can do with it. These are the problems that show up again and again in apps built quickly with AI help.
Supabase row-level security left off, Firebase rules left open, record IDs anyone can change. I check whether one user can read or change another user’s data, files or payments.
Data & API checks →OpenAI, Stripe or database keys shipped to the browser, admin routes with no login check, and API endpoints the interface hides but anyone can call.
Example: keys in browser storage →Prompt injection, leaked system prompts, and chatbots or agents that can reach data or actions they shouldn’t. Plus abuse that runs up your AI bill.
AI & LLM checks →02 / The approach
You tell me what you built.
I test it, explain what breaks,
and check your fix.
Send the link, what you built it with, and what it does with user data and AI. You get a written scope and a fixed price before I start. No surprises.
YOU GET A fixed price and a clear scopeUsing test accounts you create, I look at what your app sends to the browser, what one user can see of another’s data, and what your AI feature can be talked into. Tools help; the important questions get checked by hand.
THE FOCUS Your data, your keys and your AI featuresEach confirmed issue explains what’s wrong and why it matters in plain English, with a fix written as a prompt you can paste into Cursor, Lovable, Bolt or Replit, plus the technical detail a developer would want.
YOU GET A prioritized fix listAI tools sometimes “fix” one thing and break another. After you ship your fixes, I re-run the checks and confirm the original issues are closed. One recheck is included.
YOU GET Confirmation the issues are closedThe deliverable
Written for founders, with enough detail for any developer you bring in later.
What I tested, what I didn’t, and a short plain-English summary you can show users, investors or early customers who ask about security.
Each issue comes ranked by how much it matters, with how I confirmed it and a fix you can paste into your AI coding tool.
One recheck is included. I repeat the relevant checks after your fixes and confirm whether each issue is closed.
Fictional example. It shows the format and level of detail, not a client engagement.
03 / Pricing
Fixed prices for solo founders and small teams.
Scope and price are agreed in writing before work begins.
Most founders start here
A focused manual check of the riskiest parts of your app, before you launch or start charging.
The whole app, every role
A deeper manual review of your whole app: every user role, your AI features and the APIs behind them.
You keep shipping
You ship every week. Each month I check what changed, so new features don’t quietly undo old fixes.
Founding-client rate: my first three Full App Review clients pay $800, in exchange for permission to publish an anonymized case study they approve first. Ask about availability.
Need help applying the fixes? I can pair with you or fix agreed issues directly, quoted after your check. Ask about fix help.
Free guides
Plain-English guides to the most common problems in AI-built apps, with fixes you can paste into your coding tool.
Paste your policy SQL and get the common RLS mistakes flagged instantly. Runs entirely in your browser.
Find tables with RLS off, test as a stranger and as a second user, and fix the policies AI tools get wrong.
Check in five minutes whether your OpenAI, Anthropic or Stripe secret key ships to the browser, then fix it properly.
Twenty things to check before real users sign up or pay, from database rules and keys to AI features and payments.
Find open Firestore, Realtime Database and Storage rules, test them in the Rules Playground, and lock data to each user.
Leaked a Supabase, OpenAI, Stripe or Firebase secret? Revoke it in the right order, check for misuse and fix the cause.
Before we talk
The essentials for deciding whether a check makes sense for you.
Email me to set up a callYes, if you built your app with Lovable, Bolt, Cursor, Replit, v0 or a similar tool, or you’re a small team shipping fast with AI help, and real users are about to sign up, pay or upload their data. You don’t need a security background. If you need a formal penetration test for SOC 2 or an enterprise customer’s security review, tell me first so we can check whether this is the right fit.
The Launch Check is $400 and covers the riskiest parts of your app, with plain-English findings, copy-paste fixes and one recheck. The Full App Review is $1,200 and covers every user role, your AI features and the APIs behind them, with a shareable summary letter, a results call and one recheck. My first three Full App Review clients pay a founding rate of $800 in exchange for permission to publish an anonymized case study. The Monthly Ship Check is $300 per month after an initial check, with up to three hours of checks on what you shipped. Help applying fixes and larger work are quoted separately. Scope and price are agreed before work begins.
That’s the point. Each issue explains what’s wrong and why it matters in plain English, ranked by importance, with a fix written as a prompt you can paste into your AI coding tool. The technical detail is there too, for you or any developer you bring in later.
A link to your app, a short description of what it does and what you built it with, and two test accounts I can use. Never send me your own passwords, API keys or real customer data. Testing starts only after we’ve agreed the scope and you’ve authorized it in writing.
Exposed keys and secrets, database access rules, unprotected API routes, whether one user can reach another’s data, AI tool permissions and private data retrieval. The question is always whether someone can get at data or actions they shouldn’t. The exact checks depend on your app and the written scope.
Yes. You get a short plain-English summary of what was checked and fixed that you can share. It is not a compliance certification or a guarantee that your app is free of vulnerabilities, and the summary says so.
Every issue comes with a fix you can apply yourself, and one recheck is included. If you’d rather have help, I can pair with you or fix agreed issues directly, quoted after the check. The Monthly Ship Check covers fix verification and quick questions within its three-hour monthly allowance.
Yes. Email me and we’ll set up a short call. We talk through what you built, what it does with user data and AI, and when you’re launching. If it’s a fit, I send a written scope and fixed price. You don’t need to bring passwords, customer data or a security questionnaire.
Before you launch
Tell me what you built and when you’re launching, and I’ll reply personally with a scope and fixed price. Prefer to talk first? Email me and we’ll set up a quick call.
I reply with a written scope and fixed price. Once you approve it and set up test accounts, we pick a testing window.
Prefer email? jbluestine@bluejayappsec.com
