engine
Audit & fix engine for AI-built apps

Know what
your AI built.

Paste a repo. In a few minutes you get an audit where every finding cites its evidence — the query we ran, the answer we got.

Runs read-only. Source deleted after the scan. No account needed.

or
usually under 4 minutes · report link by email · no account needed
engine · report excerpt · scn_01M1…AKVE
scn_01M1…AKVE · report excerptmeasured
Table readable without a sessionAct
supabase/migrations/0007_members.sql:12
select count(*) from members → 1,204 rows, as anon, no session
rescan passtypecheck passtests passpolicy tests passproof of vulnerability unavailablefix verified · PR #142 opened
care run · week fourmeasured
Push to main, rescanned in 6 minutesalert sent
▲2 new ▼5 fixed
what week four looks like: fewer new, more fixed, nobody paged

Vibe-coded apps ship fast. The audit usually doesn't; so we fixed the audit.

141
checks, counted from the library
under 4 min
from paste to report, 19 scans in 20
5
verification rungs before a fix PR
100%
of findings cite their evidence — it's the rule
How it works

Scan, cite, fix, watch.

We scan read-only, cite evidence for every finding, open verified fix PRs, and keep watching under care.

engine/scan

Scan

Static engines, schema replay, and — with your say-so — live probes, in an isolated sandbox. Read-only, and your source is deleted after the scan.

Supabase RLSSecretsStripeAuthDependenciesSandboxed
engine/evidence

Evidence

Each finding carries a location and a measured-or-estimated label. The query we ran, the answer we got. No evidence, no finding.

File & lineMeasured / estimatedQuery + answerNo severity theater
engine/fix

Verified fix PRs

A fix passes a verification ladder — rescan, typecheck, tests — before we open the pull request. You review; nothing merges itself.

RescanTypecheckTestsPolicy testsYou review
engine/care

Care

Push-triggered rescans, scheduled full scans, and alerts only at the level you choose. A monthly summary of what changed.

Rescan on pushWeekly full scanAlert thresholdMonthly summary
What we check

Each check asks one specific question of your app.

141 checks across 8 families. From Supabase row-level security to Stripe webhooks — one concrete example per family:

SB-RLS-•••

Supabase RLS

a table readable without a session, proven by the query we ran

SB-KEY-•••

Keys & secrets

a service-role key in client code, with the file and line

STR-•••

Stripe

a webhook handler that never verifies the signature

AUTH-•••

Auth

a password reset flow that leaks whether an email exists

API-•••

API

a server action with no auth check inside its boundary

FE-•••

Performance

a 4 MB bundle measured five times, median reported

COST-•••

Cost

a column that averages 4 KB per row, priced at your tier

OPS-•••

Ops

no backups on the database your business runs on

From found to fixed. Every step leaves evidence.

A sample transcript. Nothing here runs against your app without your say-so, and nothing merges without your review.

scan-agent replaying schema, read-only · sandbox scn_01M1…AKVE evidence-agent select count(*) from members → 1,204 rows, as anon fix-agent opening PR #142 · verified: rescan ✓ typecheck ✓ tests ✓ care-agent push to main → rescanned in 6 minutes · no alert needed
Pricing

Two ways to work with us.

A one-time audit, or a care plan that re-asks every question on a schedule.

One-time audit

$500 fixed, one repository
  • The full report at audit depth — seven chapters, evidence bundle
  • Every Act finding verified, not pattern-matched
  • Fix PRs for what can be fixed mechanically
  • A walkthrough call if you want one

Care plan

$250/mo
  • Rescan on every push, full scan weekly
  • Alerts only at or above the level you choose
  • Two bounded fixes a month included
  • A monthly summary of what changed
Trust

Read-only, scoped, deleted.

We scan with read access and nothing else. Active probes against your live app run only after you have proven you own it.

Optional connections — a database role, a Supabase token, Vercel, Stripe — are scoped, used for the scan, and never stored in our database.

Your source never persists outside the scan sandbox. Snippets stored with findings are at most ten lines and pass a redactor.

We never execute your application. Fixes are proposed as pull requests you review; nothing merges itself without your standing opt-in.

What we keep: findings, evidence excerpts, and reports, under a retention policy you can see. What we sell: audits and monitoring. What we don't: your data.