Your database is open to anyone
When row-level security is left off, a single crafted request returns every row your users have created, with no need to break in
For software built with AI
Official partner
CoherenceCoherence is when the code does what you meant it to do. The features, the data rules and the security checks all match the product you described, including the parts nobody tested by hand. & Security audit
We check whether your app is as safe as it looks
You built a working product with AI and no engineering team. We check it for security vulnerabilities, exposed data and failures under real traffic, and tell you whether it is ready to launch. You get a prioritized fix plan: we make the fixes, or your own developer or AI tool can.
Common vulnerabilities
An app that works is not necessarily safe
These are the issues we find most often in apps built quickly with AI, and none of them appear while you click through your own product
Your keys are in the browser
API keys and service secrets are shipped to the client, where anyone who opens the browser's developer tools can read and reuse them
Users can reach other accounts
Authentication confirms who a user is but never checks what they are allowed to access, so changing an ID in the URL opens someone else's account
The app drifts from what you meant
Each AI-generated change can loosen a rule that an earlier change locked down, and because nothing throws an error, the app gradually stops matching what you asked for
The audit checks for each of these in your code and database configuration
The problem
What you can see, and what the audit shows
Shipping software you cannot inspect leaves you without the information you need to judge whether it is safe to grow. The comparison below shows what is missing and what the audit supplies.
What you can check yourself
- “It works when I use it.” You are the only person who has used it exactly as intended.
- “Nothing has broken yet.” From the outside, a safe app and an untested one look the same.
- “The AI said it was done.” The AI reports done once the code runs, which says nothing about how it holds up under real users and traffic.
What you know after the audit
- Which data is exposed, and to whom, named table by table
- Which part fails first when traffic grows, and how close you are to that point
- Where the build drifted from what you asked for
- A fix list in priority order, with a price attached to each one
The audit closes the gap between these columns
What we check
Where AI-built apps fail
Each area is reviewed by a person who has seen it fail before, so nothing is left to an automated checklist alone
Data exposure
What a stranger can extract from your database using nothing more than a browser
Keys & secrets
What was shipped to the browser, what is stored in your repository, and what should have stayed on the server
Auth & access
Who can sign in, who can act as another user, and which routes never check permissions
Drift from intent
Where the build diverged from what you asked for, such as a rule that was dropped 3 prompts ago
Under real load
The queries, limits and background jobs that work for 1 user and fail at 1,000
Untested paths
Payments, uploads, refunds and edge cases: the flows nobody has run more than once, where a silent failure looks like success
Deliverables
A plan you can act on, not a 60-page PDF
Everything is written in plain language, so you can read it yourself and present it to a board, a customer or an investor without translation
A prioritized findings report
Every issue is ranked by its likely cost to your business, and the report states openly what we are not yet sure of
A fix plan, in order
What to fix first, what can wait and what we would leave alone. The plan is yours to keep, whoever carries out the work.
An exact price for what's next
An exact total based on the number of changes and the cost per change, which you approve before any work starts
A summary you can share
Once the fixes are in place, you receive a verification summary that a customer, partner or investor can read and rely on
Illustrative example. Your report is built from your app.
Pricing
What it costs, in order of commitment
The only decision to make now is the audit. Everything after it is priced from what the audit finds, and you approve that price before work begins.
Step 1 · Start here
Coherence & Security Audit
$1,000one-time, fixed
Find out where your app stands and what it will cost to make it secure and stable
- Full security review of row-level security, exposed keys, and authentication and access gaps
- Structural health of the code, and where it drifted from what you asked for
- What is untested, and what that puts at risk
- Prioritized findings report in plain language
- A fix plan, and an exact price for the next step
Step 2 · The fix
Production-Safe
$295/ verified change
We fix what the audit found and harden your app for real traffic
- Priced per verified change, because every app arrives in a different state
- Your audit sets the count, and you approve it before we start
- A typical small app needs 6 to 10 changes
- Every change verified before it ships
- A verification summary you can hand to a customer, partner, or investor
Request an audit →
Priced from your audit findings, never estimated without one
Step 3 · Stay solid
Safe-Change Layer
$300–600/ month
Ongoing review that keeps your app secure while you keep building with AI
- Every significant change reviewed before it becomes a problem
- Reviews that catch reopened security holes and drift from what you meant
- A plain-language explanation of anything risky
- A ready-to-paste fix for each issue, so you have nothing to work out yourself
Prices in US dollars.
We review every significant change and do not monitor in real time. The audit and fixes secure your app, and this layer keeps it secure while you keep building.
Process
How the engagement works
You keep building, and we give you an independent assessment of what has been built at each stage
We review the app
We check how your data is protected, who can access what, where the build drifted, and which parts will break as usage grows
We report in plain language
What is sound, what is at risk and what we are not yet sure of, written so you can present it to your board or investors
We review ongoing changes
As you keep building, we review each significant change and catch new issues before they reach production
Proof
Projects reviewed with these checks
Some of these projects were audits of apps written by other teams. We built the rest ourselves, and each one went through the same review before launch.
-
Audit Consulting Safe launchGIFCT
The Global Internet Forum to Counter Terrorism, founded by Meta, Microsoft and YouTube, needed one place for its Operating Board and Independent Advisory Committee to work. We built the governance portal and took it from build to launch.
See it in the portfolio3Founders2Bodies1Portal -
AuditSnapCycle
An app that identifies recyclable materials from a single scan, heading for both app stores. We accompanied the team through their technology choices and architectural decisions, the calls that are expensive to reverse later.
See it in the portfolio2Platforms1Review0Rewrites -
Takeover MaintenanceReactView
Coaches record a game, review it frame by frame, draw the play on a live tactics board, and see who watched. We joined mid-project and took over product development.
Read the case study500+Teams50+Countries99.9%Uptime -
Development Safe launch MaintenanceO Lab Plus
An independent optical laboratory in Brossard, Québec, serving eyecare clinics since 1987. We develop and maintain the platform, and have increased the speed and quality of each release.
Read the case study1987SincePlatformDevelopmentOngoingMandate -
From scratch
FitCook Foodz
A recipe library with full nutrition data, a store integrated with Shopify, a premium subscription, cooking courses and a community feed. Live on the App Store and Google Play.
Read the case study2Stores5.0Rating5K+Downloads -
From scratch
Relance Métabolique
A Québec coaching program on one app the client owns: the full curriculum, a coaching messenger with voice notes and scheduled broadcasts, and every client's progress in one database
Read the case study4PhasesFlutterBuilt withIn-appCoaching -
From scratch MaintenanceDrouin CTB and ti360
Each year, 2 Québec accounting firms collect the same tax file from every client. We built the portal that requests the documents, walks the client through the questionnaire, and sends the reminders.
Read the case study2Brands servedSharedCodebaseAutomaticReminders -
From scratchSafari Condo
A Québec motorhome maker receiving more support requests than its team could read. We automated the support desk, so every request is categorized and arrives with a drafted reply and the relevant documentation attached.
Read the case studyAutomatedTriagePre-writtenRepliesNeverAuto-send -
From scratch ConsultingShiploose
A modular construction manufacturer moved every material request between its sites and its warehouse through one shared spreadsheet. We scoped the replacement, then built the application that took its place.
Read the case study
Where this is going
From one app to a whole organization
Today, we secure one app at a time and keep it secure as it changes. Our longer-term goal is coherence everywhere, where the people, policies, processes and AI in an organization stay consistent with each other.
We start with a single app because that is where the need is most urgent today, and we are building toward whole organizations that stay consistent with what they intend to do
Now
The audit you can act on
An audit of what is broken, exposed or drifted from what you meant, reviewed by a person and written in plain language
Next
Continuous coherence checks
A layer that keeps checking your app against what you meant while you change it, so the findings stay current after the report is delivered
The horizon
The coherent organization
People, policies, processes and AI kept consistent with each other across a whole organization, beyond a single app
This describes where we are heading, not services we offer today
FAQ
What clients ask before they book
I built this with AI and I'm not technical. Can you still audit it?
Yes. The audit is designed for founders who are not technical. We work inside the tools you already use and are an official Lovable partner, so you will not need to explain your architecture or bring an engineer to read the report.
Will you break my app?
No. The audit is read-only, so we do not change anything in your app. If you go ahead with fixes, you approve the scope of every change first, and we verify each one before it ships.
What if you don't find anything serious?
Then you receive that conclusion in writing, and it is the deliverable: documented confirmation that your app is sound, which is a useful result in its own right
Do I have to buy the fixes from you?
No. The findings report and the fix plan are yours to give to your own developer, another studio or your AI tool. We would welcome the work, but the audit is a complete deliverable on its own.
How is this different from running a security scanner?
A scanner matches known patterns. We check whether your app does what you meant: that the data is locked down, the access rules are consistent and the app holds up under real users. We also state what we are not sure of, which a scanner cannot do.
What does it cost to fix what you find?
$295 per verified change. Your audit sets the number of changes, typically 6 to 10 for a small app, and you receive an exact total to approve before any work starts. Prices in US dollars.
Next step
Start with the audit
The audit gives you a plain-language account of your app's security and a priced plan for everything it needs fixed