Production Audits · coming soon
Not open yet.
I expect to open the first slots in early 2027. Until then, this page is the plan, not a booking page.
App de Bock / Production audit
Find what your AI missed.
A 3-day security review for apps built with AI. I read your repo like someone trying to get in, then hand you a plain-language list of what’s broken. Worst first.
PRODUCTION AUDITSLOTS: 2 / MONTH
€1,500fixed
Launch offer: €750 for the first five clients, in exchange for a testimonial.
If it’s not worth it, I’ll say so.
- STACK
- Next.js // Supabase // Vercel // Node
- TIME
- 3-day sprint · fixed scope
- YOU GET
- Report + 30-min walkthrough
- TERMS
- EU-based · NDA on request · code not retained
What I check
The holes AI-generated code keeps leaving.
Cursor and v0 get you to 90%. The last 10% is what they’re worst at, and it’s exactly where strangers get in.
CHECK 01
Supabase RLS
Tables the browser can read, or write.
CHECK 02
Ownership checks
Endpoints that check if you’re logged in, but not whose data you asked for.
CHECK 03
Server Actions
Actions anyone on the internet can call.
CHECK 04
Secrets in bundle
API keys shipped to every visitor’s browser.
CHECK 05
Dependencies
Packages with known, published vulnerabilities.
CHECK 06
Preview deploys
Preview URLs wired to your production database.
CHECK 07
Stripe webhooks
Webhooks that trust whoever calls them.
CHECK 08
Whatever else I find
If it’s broken and it matters, it goes on the list.
How it works
Triage
A 15-minute call. If it’s not worth it, I’ll say so.
Access
You share the repo. NDA on request.
Review
I read your code like someone trying to get in.
Report
Plain-language findings, worst first, plus a 30-min walkthrough.
What you get
A receipt, not a 60-page PDF.
- 01Every finding: what it is, why it matters, how to fix it.
- 02Sorted worst first: critical, fix before launch, fix this month.
- 03A 30-minute walkthrough so nothing gets lost in translation.
- 04Your code isn’t retained afterwards. NDA on request.
DIAGNOSTIC RECEIPT
SAMPLE · Audit #[000] · 3 days
- Supabase RLS
- 3 tables open
- Ownership checks
- 7 endpoints
- Server Actions
- 2 unauthenticated
- Secrets in bundle
- 1 live key
- Preview deploys
- prod DB attached
- CRITICAL
- 4
SUGGESTED FIXES INCLUDED
Questions
Fair questions, straight answers.
Is this a pentest or a compliance audit?
Neither. It’s a hands-on code review of your repo. If you need SOC 2 or ISO paperwork, I’m not your guy.
Which stacks do you cover?
Next.js, Supabase, Vercel and Node. If yours is close, ask during triage.
Do you keep my code?
No. Code isn’t retained after the audit, and I’m happy to sign an NDA first.
What if my app is already fine?
Then the report says so, and you launch with a clear head. The triage call usually tells us upfront whether it’s worth it.
Two slots a month