We use analytics cookies to see how the site is used. Privacy policy

Quantum Craft
Start a conversation
Free check

Is your AI-built app ready for real customers?

Five checks for apps built with Lovable, Bolt.new, Replit or v0. See what to fix first.

Start the five checksSee a sample audit report
  • Five checks
  • A sample audit report
  • Answers stay in your browser
01The checks

Five checks

Quantum Craft's AI-built app check is a free test of five things an app made with Lovable, Bolt.new, Replit or v0 should have in place before it takes real customers.

The five come from the checks in our AI-built app audit. Answer yes only if you or your developer have tested it. The result is your own reading, not an audit.

Last reviewed

Illustrative result

Indicative UI, sample data. Checks that need attention come first, in the order the gaps start to hurt, and checks that passed come last. The highlighted row comes first.

Your checks, coloured as you answer

  1. Who can see whose dataNot answered yet
  2. Sign-in and access rulesNot answered yet
  3. Payments and webhooksNot answered yet
  4. Secrets and keysNot answered yet
  5. Backups and recoveryNot answered yet

A check takes its colour as soon as you answer it.

How to answer

Yes, tested
You or your developer have tried it and seen it hold.
Not sure
It has not been tested, or you do not know. That counts as something to check.
No
You know it is missing, or you have seen it fail.

  1. Check 1 of 5

    Who can see whose data

    Why it matters
    An app can show each customer only their own rows and still let anyone who asks the database directly read every row. Access rules in the database stop that, and they are easy to leave out.
    How to test it
    Create two accounts. With the first account's login, ask for the second account's records without going through the screens.
    Have you tested that one customer cannot read another customer's records, even by asking the database directly and skipping your screens?

  2. Check 2 of 5

    Sign-in and access rules

    Why it matters
    AI app builders are good at hiding buttons. A customer who never sees the admin screen can still send the request that screen would send, and only the server can refuse it.
    How to test it
    Sign in as an ordinary customer and try the staff or admin actions with that login. Then try them signed out.
    Does the server refuse a signed-out visitor, and a customer trying a staff or admin action, even when the request skips your screens?

The five checks in the order the result lists them, which is the order the gaps start to hurt once real users arrive: who can see whose data; secrets and keys; sign-in and access rules; payments and webhooks; backups and recovery. Highlighted: who can see whose data, the gap that hurts first.

  1. Check 3 of 5

    Payments and webhooks

    Why it matters
    If the browser can tell your app that a payment worked, anyone can. Only the provider's webhook comes from the provider, and your server can check that it did. Without it, orders and money drift apart.
    How to test it
    Make a test payment, a failed payment and a refund, and check that your records match the provider's dashboard each time.
    Is an order marked as paid only when your payment provider's webhook says so, and never because the browser reported it?

  2. Check 4 of 5

    Secrets and keys

    Why it matters
    Anything that ships with the page can be copied. A payment, email or AI model key in browser code lets anyone act as your app or run up your bill, and a database service key skips every access rule.
    How to test it
    Search the scripts your live app serves, and your repository's history, for anything shaped like a key. A key deleted last month is still in the history.
    Are all secret keys kept on the server, with none in the code the browser downloads or in your repository?

  3. Check 5 of 5

    Backups and recovery

    Why it matters
    A backup nobody has restored is a hope. The first restore should be a rehearsal, not the worst day of the year, and a bigger customer's security questionnaire will ask how long one takes.
    How to test it
    Restore last night's backup to a scratch database, time it and compare it with the live data.
    Have you restored a backup to a test copy, and do you know how long it took?
0 of 5 answered

What to fix first

Answer all 5 checks, then choose Show what to fix first.

From the check to the audit: the five checks are free and your answers stay in your browser; the AI-built app audit is a fixed £3,500 and takes about a week; it ends in a report that ranks each finding, like the sample below. Highlighted station: the audit.

02The report

A sample audit report

Every finding in the report has the same four parts. This extract uses three generic findings.

Illustrative sample, not a client report. The highlighted finding comes first.
  1. Payment status is taken from the browserBefore you take payments
  2. Staff actions are hidden on screen but not refused by the serverBefore more users sign up
  3. An AI model key is visible in the browserThe same week
Illustrative sample, not a client report
Audit report extract
FindingWhy it mattersShape of the fixOrder
Payment status is taken from the browserAnyone can tell the app that a payment worked, so an order can be marked paid when no money arrived.Confirm payments from the provider's webhook, verify its signature and ignore what the browser reports.1. Before you take payments
Staff actions are hidden on screen but not refused by the serverA customer who never sees the admin screen can still send the request that screen would send.Write the rule for each role on the server, with one test per rule that fails if the rule is removed.2. Before more users sign up
An AI model key is visible in the browserAnyone can copy a key that ships with the page, use it for themselves and run up your bill.Rotate the key, move the calls to the server and cap what each user can spend.3. The same week

The full report ranks every finding like this, maps where personal data goes and prices harden, refactor and rebuild.

If nothing needs fixing before you take payments, we say so and sell you nothing else.

The audit is a fixed £3,500 and takes about a week. If you go ahead with the next stage within 30 days, the fee for your first step comes off its price.

03Limits

What this check leaves out

What the five checks leave out, and the audit looks at: validation on the server, tests on the paths that take money, alerts when the app fails, limits on what AI features can cost and a review of where personal data goes. Dashed: not covered by the five checks. Highlighted station: the five checks.

Five checks are a first pass. They leave out validation on the server, tests on the paths that take money, alerts when the app fails, limits on what AI features can cost, and a review of where personal data goes. The audit looks at all of them, and what we check first in an AI-built app shows how to test most of them yourself.

It is also not a penetration test, which attacks the running app. Scan, audit or penetration test explains how the three differ.

Start a conversation

Send us your prototype.

Tell us which tool built the app, where the repository lives and what is breaking. We'll reply with how the audit would run. It costs a fixed £3,500.

More on vibe code rescue
What do you need?

Please leave passwords and keys out of the form.

The first call is free, and there is no sales pitch.

What happens after you get in touch

  1. We reply within one working day

    By email, to arrange a time for the call.

  2. A free 30-minute call

    With a senior engineer, about what you are building or deciding.

  3. The fee in writing first

    If a first step is worth taking, you get its exact fee in writing before any work starts.

contact@quantumcraft.ukLondon, UK