For founders who build with AI tools
Your app works. Is it leaking?
AI tools build fast. They also leave doors open. Here is what strangers find.
Your customers
Anyone can download your customer list.
Names, emails, phones. Copied once, out forever.
One AI-built app leaked 18,697 user records. Source: The Register
Your revenue
Users unlock your paid features for free.
No payment. No alert. You never find out.
Our check did it in under a second, on a test app built with Lovable.
Your bill
A bot runs up your AI bill overnight.
No limit, no ceiling. You pay for every call.
Our check: 5 calls in a row, none refused.
98% of scanned AI-built apps had at least one security issue. Founders who check first can fix it before anyone else finds it. Source: Symbiotic Security, 1,072 apps
Does your app have them? Find out in seconds, free.
tidybook-sweet-spot.lovable.app
Ready
Public checksWhat any visitor can see
Opening your app: waiting
Reading the code every visitor downloads: waiting
Can someone spend your money with your own keys?: waiting
Finding your database: waiting
Can a stranger download your customer list?: waiting
Can bots sign up without limits?: waiting
Did secret files ship with your app?: waiting
Is your source code public?: waiting
Are browser and email protections on?: waiting
Deep checksAs two new users and as a stranger
Can one customer see another’s data?: waiting
Can someone get paid features or admin rights for free?: waiting
Can one customer change another’s orders?: waiting
Can anyone upload files at your cost?: waiting
Can a bot run up your AI bill?: waiting
Example: a real scan of a booking app we built with Lovable and left with common mistakes (2026-10-31).
Six areas we test
The free check sees what any stranger sees. The deep checks act as real users.
- Free check
Your customer list
Records a stranger can read without signing in.
- Free check
Secret keys
Keys that let anyone spend your money, inside the code every visitor downloads.
- Deep check
Paid features
Orders marked as paid, credits or admin rights, for free.
- Deep check
Other customers’ data
One customer seeing or changing another’s records.
- Deep check
Your AI bill
A bot calling your AI helper again and again, at your cost.
- Free check
Sign-ups and files
Bots signing up without limits, and secret files shipped with your app.
What the report looks like
Where each problem is, the proof and the fix. From $29.
Report
Tidybook
Built with Lovable · 5 findings
- Critical
- 1
- High
- 2
- Medium
- 1
- Low
- 1
- F-01criticalAnyone can read the reviews table: 12 names, emails and phone numbersFix: A public view without personal data
- F-02highAn order can be marked as paid without payingFix: Confirm the payment on the server
- F-03highA bot can run up the AI bill: no usage limitFix: A daily limit per user
- F-04mediumBots can create unlimited fake accountsFix: Turn on email confirmation
- F-05lowSome browser protections are switched offFix: Turn on two security headers
The fix for F-01, ready to paste into your AI tool
The reviews table can be read by anyone, including the email and phone columns. Create a view called public_reviews with only the name, rating and text columns, and use it on every public page. Then allow only admins to read the reviews table itself.
Check for free. Pay only for the report
Step 1
Paste your link
Free, in seconds
9 checks of what any stranger can see. We count records; we never keep your customers’ data.
Step 2
Get the deep checks
Free, by email within 24 hours
5 checks as real users: other customers’ data, free upgrades, and your AI bill.
Step 3
Choose your report
From $29
Where each problem is, the proof and the fix. Add fix prompts, or a senior engineer’s review.
Choose your report
A leaked customer list cannot be taken back. The report shows where each problem is and how to fix it. Re-checks are always free.
Report
$29
Within 24 hours
- What is wrong, where, and the proof
- Why it matters for your business
Report + fix promptsRecommended
$49
Within 24 hours
- Everything in the report
- A prompt for each problem, to paste into your AI tool
Report + fix prompts + review
$199
Within 72 hours
- Everything in the report and the fix prompts
- A senior engineer checks every finding and writes a note
A senior engineer who has also been a founder
A senior software engineer with 14 years of experience, who has also been a founder, wrote these checks and reviews your findings in the $199 report.
Every layer of a modern app
The mobile app, the backend, the database, the cloud it runs on, and now the AI agents inside it.
Learn more
LidTight is run by a senior software engineer with 14 years of experience. When we review your app, we know how each layer fits together, and where to look.
Our engineer has also been a founder, so we know what founders go through. In the reviewed report, the engineer checks every finding and writes a note for your app.
Our promise
- The free check reads only what any visitor can see. It counts records and never keeps your customers’ data.
- The full report, with the details and fixes, comes when you pay. You leave your email, and we send it there.
- We use our own test users, change only our own test data, and tell you what we leave behind.
- We keep your app’s link, the findings with keys masked, and your email if you give it. Never your app’s code or your customers’ data.
Questions founders ask first
Is the check really free?
Yes. The free check and the deep checks are free. You pay only if you want a report: $29, $49 or $199. Re-checks are always free.
What counts as a serious problem?
A finding we rate high or critical: a stranger or a normal user can read or change other people’s data, get paid features for free, or run up your bill.
Why don’t you show where the problem is?
The free check proves the problem is real: what it is, how serious, and how many records. Where it is, the proof and the fix are in the report.
What do the deep checks do to my app?
They sign up two test users, create one test order, try what a normal user could do with it and change it back, and call your AI helper up to 5 times. We count records; we never keep your customers’ data. If your app does not let users delete orders, the test order stays, and we tell you which one.
Why do you ask for my email?
The deep checks act inside your app, so we run them only for its owner. You confirm your email, we look at each request, and you get the results within 24 hours.
Do you need my password or my code?
No. The checks use your live app, like any visitor or new user. If your app asks new users to confirm their email, the signed-in checks are skipped, and the results say so.
My AI builder already scans my app. Why use you?
Builder scans read your code and your database rules. We test how your live app behaves: who can see what, who pays for what, and who can run up your bill.
What is in each report?
$29: where each problem is, the proof and why it matters. $49: plus a prompt for each problem, to paste into your AI tool. Both arrive within 24 hours. $199: plus a senior engineer who checks every finding and writes a note, within 72 hours.
Can my AI assistant do this for me?
Mostly. Ask it to read the /llms.txt file on this site, a page written for AI assistants. It can run the free check and explain the result. You confirm your email for the deep checks and, if you choose, pay.
My AI tool already checks security. Why do I need this?
Your AI tool reads the code it wrote. We test your live app from the outside, as a stranger and as two new users. It is a second check, by a tool that did not write the code.
Which apps can you check?
Any app that is live on the web. The database checks work with Supabase (including Lovable Cloud), Base44 and Firebase. The other checks work on any app.
Check your app before a stranger does
While a problem stays open, anyone can use it. The free check takes seconds and needs no sign-up.