What We Deliver
Find the holes before someone else does.
AI coding tools get an app working fast, but they rarely get it locked down. The same problems come up again and again: database rules that let anyone read every row, secret API keys shipped to the browser, admin pages any signed-in user can open, and payment webhooks anyone can fake.
We test your app the way an attacker would, but only with your written authorization and without touching real user data. You get a report that explains each finding in plain English, shows the proof, rates how serious it is and says exactly how to fix it. If you want, we fix the issues for you by pull request and re-test to show each one is closed.
No audit can promise an app is perfectly secure. What we promise is a careful, honest check of the places these apps most often go wrong, and a clear list of what to do next.
Start a ProjectStacks We Check
Why Ark Crew
- Senior developers on every project, since 2019
- A clear written quote: fixed price or time and materials
- You own the code, no lock-in
- Support and maintenance after launch
- A reply within 24 hours
From our blog
What We Check
01Database access rules
Supabase row-level security, including tables with RLS turned off or policies like USING (true); Firebase security rules; storage buckets open to anyone.
02Secrets and keys
Service or secret keys in the code your visitors download, .env files committed or served, and keys left in git history.
03Sign-in and access
Whether one user can read or change another user's data by changing an ID, admin routes that are hidden in the interface but not protected on the server, password reset and email verification.
04Server endpoints and edge functions
Missing sign-in checks, user input that reaches SQL, shell commands or file paths, and requests the server can be tricked into making (SSRF).
05Payments
Webhooks that are not verified, so anyone could fake a payment, and prices taken from the browser instead of the server.
06File uploads
File type and size limits, and public links to files that should be private.
07Rate limits
Sign-up, login and password reset, and paid AI endpoints that someone could call thousands of times on your bill.
08HTTPS and browser protections
HTTPS and HSTS, Content Security Policy, cookie flags and CORS settings.
09Dependencies
Packages with known vulnerabilities (npm audit, osv-scanner) and outdated frameworks.
10Backups
Whether backups exist and whether a restore has actually been tested.
11Logs
Secrets or personal data written to logs.
How We Work
Our Process
Authorization
Before any test you confirm in writing that you own the app and list the domains we may test. Nothing starts without it.
Audit
We go through the checks on this page, starting with the public ones and then, with the test accounts you give us, the signed-in ones.
Report
You get a plain-English report: each finding with its proof, how serious it is and how to fix it, most urgent first.
Fix (optional)
If you want, we fix the issues ourselves and send the changes as pull requests you can review before anything goes live.
Re-test
We test again and show you that each issue is closed.
Packages
Choose How Deep We Go
Quick Scan
A first look from the outside, using only what anyone on the internet can see.
- Keys and secrets exposed in the browser
- Database rules open to the public
- Security headers and SSL
- Admin routes reachable without the right access
- A one-page report
Full Audit
Everything in the Quick Scan, plus signed-in testing with two test accounts you give us.
- Access between users
- Admin paths
- Payments and webhooks
- File uploads
- Rate limits
- Backups
- A full report with proof and fixes
Audit + Fix
The Full Audit, then we fix what we found.
- Everything in the Full Audit
- Fixes sent as pull requests you review
- A re-test showing each issue closed
Every app is different, so we quote each one after a short look at its size. Ask for a free quote.
How We Keep It Safe
- Written authorization first: you confirm you own the app and which domains are in scope.
- No destructive tests and no real user data. Proof uses our own test accounts.
- Findings go to you only and are never published.
- We need read access to your repository and two test accounts, never your production admin passwords.
FAQ
Common Questions
Do you need my passwords?
No. We ask for read access to your code repository and two test accounts in your app. We never ask for your production admin passwords, database passwords or secret keys.
Will you break my app?
No. We don't run destructive tests, and we never touch real user data. Checks that carry any risk are run on a copy of the app or only against our own test accounts.
Which stacks do you work with?
Supabase, Firebase, Next.js, React and Node first, since that is what most AI coding tools produce. If your app is built on something else, ask us and we'll tell you honestly whether we can cover it.
Can you guarantee my app is secure afterwards?
No honest audit can promise that. We check the places these apps most often go wrong, show you what we found with proof, and help you close it. That removes the common, easy-to-find holes attackers look for first.