Free security check for AI-built apps
Built an app with Lovable, Bolt, Replit, Cursor or Claude Code, and not sure it's safe to put real users on it? Send me the repo. With your permission, I'll run the standard free security tools on it, take a short look myself, and reply privately with anything serious and what to do first. It's free, and you don't owe me anything.
I'm Bryce Watson. I spent 11 years as a software engineer at eBay, and I'm currently contracting with Portland State University, building an AI tool from prototype toward production.
The short version
You send a repo link and a few lines about the app. I run the tools below and spend about an hour reading. You get a private email with what I found, most urgent first, and the first step to fix each one. I don't touch your live app, I never need your keys, and I delete my copy of your code when I'm done.
Last updated September 26, 2026
1 What I run, with your OK
- Gitleaks or TruffleHog, over your whole git history. They find keys and passwords in the code, including ones you deleted that still sit in an older commit. TruffleHog can try each key it finds against the service to see if it works. I turn that off: I never use a key I find.
- Semgrep, with its free rules. It flags common code mistakes, like text from a web address landing in the page unescaped, or a query built from user input.
- Supabase Security Advisor. It lives in your Supabase dashboard, so you run it, not me. I'll tell you where to click. If you paste me the results, I'll tell you which ones matter for your app.
- GitHub secret scanning and push protection. They warn you about leaked keys and block new ones before they're pushed. On a public repository they're free, and I'll tell you how to check they're on. Private repositories on a personal account don't get them, so I'll suggest what to use instead, like running Gitleaks before each commit.
- A short look myself. The tools miss the problems I see most often in these apps: database rules that let one user read another's data, server functions that don't check who's calling, and prices or credits the browser gets to decide.
The tools run on my own computer. I also use AI coding tools (Claude Code and OpenAI Codex) to read code faster, the same as for a paid review, and they send the parts of your code they read to Anthropic and OpenAI to process it. If you'd rather I didn't use them on your code, say so on the form and I'll do the check without them. Nothing else leaves my computer.
2 What you get back
- A private email with each finding: where it is (file and line), what it means in plain words, and the first thing to do about it. The most urgent comes first.
- If a key looks exposed, I'll tell you to replace it. I can't tell you whether it still works, because I don't try it.
- A plain note of what I didn't check. An hour with a few tools finds the obvious problems, not all of them. A clean result doesn't mean the app is secure.
- If you want help fixing something, ask, and I'll quote it. If you don't, that's the end of it. I won't follow up with a sales pitch.
3 What I need from you
- The repo. Public on GitHub: just the link. Private: add me (BryceEWatson) to the repository. On a personal repository, GitHub gives every collaborator write access, not just read, so remove me when you get my reply. In an organization, you can give me the Read role instead. Rather not add me? Email me a zip of the project, or a share link if it's over 25 MB. GitHub's Download ZIP leaves out the history, so I can't check it for deleted keys. If you zip the folder yourself, include the hidden
.gitfolder. - A few lines about the app: what it does, which tool you built it with, whether it has real users yet, and anything you're worried about.
- Your OK: that it's your app, or you have the owner's permission, and I can run the tools above on it.
Please don't send keys, passwords, .env files, database exports or customer data. I don't need any of them, and I won't ask.
4 What I never do
- I don't sign in to, probe or scan your live app. The check reads the code you sent, nothing else.
- I don't use, test or keep any key or password I find.
- I don't share what I find with anyone, and I don't publish anything that identifies you or your app without your written OK.
- I delete my copy of your code once I've sent my reply.
It's the same standard I follow for the free notes I send about problems in public code: how I report security issues.
5 The free check and the $400 review
The free check is a quick first look. The launch review is the full job.
| Compare | Free check | Launch review |
|---|---|---|
| What I read | Your repo, with the tools above and about an hour of my own reading | All your code and settings, tested with logins you set up, across seven areas, from security to code health |
| You get | A private email: findings, most urgent first, and a first step for each | A written report ranked Critical to Low, a clear answer on whether to launch, a fixed price for each fix, and a 30-minute call |
| When | I reply within 2 business days, and the check usually follows within 5 business days of that | The report in 2 business days, once I have the code and a test login |
| Cost | Free | $400, with a full refund if it wasn't worth it |
You don't need the free check before booking a review, and you don't need a review after the free check. See a sample review report →
6 Send your repo
Why free? It's how people see my work before deciding whether they want a paid review. That's the whole catch.
I do a few of these a week, in the order they arrive. I'll reply within 2 business days from bryce@watsonstandardco.com to confirm, and to say when you'll hear back if there's a queue.
Thanks, it's on its way to me. I'll reply within 2 business days from bryce@watsonstandardco.com. If your repo is private, you can add me as a collaborator now or wait for my reply.
Don't paste keys, passwords or customer data into this form. It goes to my inbox through the Web3Forms relay, I use it only to reply, and I don't share it.