False start
Don't waste your idea on a false start.
The AI did a great job. You built a real app in weeks. A shakedown puts experienced eyes on it before you launch or raise. A principal engineer who has done this before goes through the whole app, ranks what he finds, and hands back fixes your own AI can apply. Quoted up front for the size of your app.
Shakedown report
Sample- P1Exposed API key in the client bundleCritical
- P2Open data: any visitor can list every recordCritical
- P3Broken access control on the admin routeHigh
- P4Secrets committed to the repo historyHigh
A sample report, from a fictional app. Every finding ships with a fix your own AI can apply.
Cheap insurance
Four things that can turn a launch into a postmortem
You've seen the posts: an app gets hacked the week it launches. The cost is never the fix. It's the downtime, the lost data, and the trust you can't buy back. Then comes the public postmortem you never wanted to write. A shakedown finds these before launch, when they're cheap to fix.
Exposed credentials
An API key, token or service-role secret sitting in the client bundle, the repo, or the repo history.
After launch: anyone can read it and use it to read or write your whole database. Lost data, lost trust.
Missing auth or RLS
A table with no row-level security, or a route that skips the ownership or role check.
After launch: any visitor can list every record, including other people's. Lost data, lost trust, the public postmortem.
Prompt injection in your own AI feature
Your app's AI feature takes input from a stranger, and that input is a door into your data and your actions.
After launch: a stranger drives your feature against your data. Downtime, lost trust.
A wiped database
No version control, no backup. One bad migration, or one bad actor.
After launch: your data is gone for good. Lost data, downtime.
Built with any of these?
The tools did their job. This is the step after them.
A shakedown covers the apps the AI builders and AI editors generate, and the stacks they run on. Naming a tool is a fact, not an affiliation.
The stacks they generate
- React / Vite
- Next.js
- Supabase
- Firebase
- Postgres
- Prisma
- Drizzle
- Clerk
- Auth.js
- Stripe
What we check
The things AI-built apps keep shipping with
Exposed keys
API keys, tokens and secrets that ended up in the client bundle or the repo. We find them, rank them, and hand them back as a fix.
Open data
Records any visitor can read or write. We check the access rules, not just the code, and show you what is exposed.
Broken access
Routes and actions that skip the check. We trace the path a stranger would take and close the ones that are open.
Those are three of the common pitfalls, and we look for many more.
The offers
Three ways to book a shakedown
Staged, so you can start small and go further. Every price is "from". Each shakedown is quoted up front by the size of your app, and fixed once agreed.
Quick Shakedown
from AUD 750
The focused shakedown: the highest-risk checks on the parts of the app that matter most.
- Exposed keys, open data, broken access
- A ranked report with fixes
- Quoted by the size of your app
Full Shakedown
from AUD 1,500
The full shakedown: every check, across the whole app, plus the clean-up that makes it cheaper for AI to keep working in.
- Every check, across the whole app
- A ranked report with fixes, then a walkthrough
- The "engineer ready" clean-up
Launch-ready
from AUD 2,500
The Full Shakedown plus the launch or raise prep: a written brief your first hire or your AI can work from.
- Everything in the Full Shakedown
- A written brief for your first engineering hire
- Quoted by the size of your app
Not sure which one? Choose "Not sure yet" when you book and Adam will help you choose.
How it works
From enquiry to report
- 1
A short scoping reply
You send a few details. Adam replies with a fixed quote for the size of your app. No call needed to get the price.
- 2
Read-only access
You share the repo with read-only access. Nothing is changed, nothing is deployed.
- 3
The report, then a walkthrough
You get a ranked report of what was found, with fixes your own AI can apply. Then a walkthrough of it.
Fair question
You built a real app with your AI. Why pay a stranger to judge it?
You didn't build it to have a stranger tell you it's broken. A shakedown is experienced eyes going through the whole app before you launch or raise. A principal engineer who has done this before ranks what he finds and hands back fixes your own AI can apply. Quoted up front for the size of your app. You keep the code, the fixes and the call on what to do next. You're paying for the blind spots you can't see from inside the build.
Who is behind it
A principal, not a panel
Adam is a Principal Software Engineer with over ten years' experience. He has worked on security at a fintech platform used by major banks, and was the founding principal engineer on an AI product.
A real, principal software engineer reviews what the AI built. The tools did their job. A shakedown is the experienced-eyes pass over the whole app before you launch or raise. You get ranked findings, and fixes your own AI can apply.
More about AdamBook a shakedown
Send a few details and you'll get a fixed quote for the size of your app, up front.