Your AI-built app works. Is it safe?
Shipworthy is a check-up for apps built with Lovable, Bolt, Replit, Cursor, or Claude Code. A senior engineer examines yours and tells you — in plain English — what's solid, what's risky, and what to fix first.
Illustrative readout. Findings of this kind are documented in published 2026 security research on AI-built apps.
AI writes apps that look finished. Looking finished is not the same as being safe.
380,000
live AI-built apps found leaking user data on the open internet.
1 in 9
vibe-coded apps expose their database keys — anyone can read, edit, or delete their data.
1.5M
API keys exposed by a single AI-built product — one missing database rule was the whole story.
None of these founders were careless. The tools simply don't tell you what they didn't build: login checks, data rules, rate limits, backups. That's what an examination is for.
How the examination works
Intake — drop your app's address
That's the whole form: your URL and your email. No call, no payment, no access to your code needed for the first pass.
Diagnosis — a free report within 24 hours
We check the failures AI tools most often leave behind — exposed keys, open databases, broken login logic, missing limits — and explain each finding in plain English.
Treatment — fix it yourself, or we do it
The report is yours either way. If you want help, prices are fixed and listed below. No hourly meters, no surprises.
What a finding looks like
From the free pre-check
Critical · data exposure
Your database lets anyone read the users table — names, emails, everything. This is the exact flaw behind most vibe-coded app breaches.
Sample content, shown as it appears in a report.
The same finding in a full audit
Critical · data exposure · RLS-01
Row-Level Security is disabled on the users table. Impact, who can exploit it, and how we verified it — then the fix:
alter table users enable row level security; create policy "users read own row" on users for select using (auth.uid() = id);
Every audit finding ships with the exact fix — as code or as a prompt you can paste into your AI tool — plus a re-check once you've applied it.
Fixed prices, on the page
You never pay to talk. You pay for deliverables — after the free check has shown you exactly what you'd be paying for.
Pre-check
Free
Automated scan + an engineer's eye over the result. The biggest risks, in plain English, within 24h.
Start nowFull audit
€390 fixed
Deep examination: security, data, auth, costs, resilience. Written report, every finding with its exact fix. 3-day delivery.
After your free checkHardening sprint
€2–5k scoped
We fix everything the audit found and make the app production-grade. Scoped in a free 15-minute call; half up front, half on delivery.
Book a 15-min scoping callCare retainer
€500+/mo
An engineer on watch: monitoring, updates, small fixes, and a human who answers when something feels wrong.
For apps in productionThe engineer behind Shipworthy
Shipworthy is run by Pouyan Ahmadpour, a senior software engineer in Amsterdam with 10+ years across payments, banking, trading systems, and national-scale retail logistics — domains where software failure costs real money, and "it seems to work" is never enough.
Based in the EU and GDPR-aware by default: if your app has European users, a data leak isn't just embarrassing — it's a compliance emergency. Your app and report are handled confidentially, and we never store your users' data.
Fair questions
Do you need my code or passwords?
Not for the free pre-check — it examines what's visible from outside, which is exactly what an attacker sees. A full audit goes deeper with read-only access you grant and can revoke anytime. We never ask for passwords.
My app was built with a different tool — is it covered?
Lovable, Bolt, Replit, v0, Cursor, Claude Code, Windsurf, or hand-rolled with AI help — the underlying stacks (React, Next.js, Supabase, Firebase, Vercel) are the same, and those are home turf.
What's the catch with the free check?
No catch: it's how you find out whether the paid work is worth it, and how we earn the right to ask. If your app comes back healthy, the report says so — plainly.
What if my app has real users already?
Then you're exactly who this is for. Findings that put live user data at risk are flagged for immediate action, and urgent fixes can start the same week.