Auth and data access
Who can read or change records, whether row-level rules match the product, and whether admin paths are actually gated.
What we check
The failures that block a launch
The audit stays on the paths that usually break an AI-built or no-code MVP. It is not a full rewrite.
Payments
Checkout, webhooks, retries, and refunds. We look for charges that succeed in the UI and fail in the ledger.
Secrets and deploys
Keys in the repo or the client bundle, environments that drift, and a release path that cannot be repeated.
What you get
A written list, then a choice
You can hand the findings to your own team. If you want us to close them, that is a second fixed price.
Written findings
Each blocker is named, with where it lives in the repo and why it matters before launch.
Ranked list
What blocks launch, what can wait, and what is noise. You can act on the list without us.
Optional fix-up sprint
If you want the fixes done, we quote a separate fixed-price sprint for the items you choose. The audit stands on its own.
Who it is for
The same three problems as the homepage
Homepage and this page name the same people. We do not add a fourth audience here.
Non-technical founders
The lead offer. You have an AI-built or no-code MVP and need someone to open the repo before users or payments depend on it.
Seed-stage healthtech
If an AI feature handles patient data, the audit includes access control and a written account of how that data moves. We do not claim a HIPAA certification.
Clinics
Scheduling and admin automation can be quoted as new work. Mr Sked is scheduling software we have shipped. It is not a clinic deployment.
Questions
Before you send the repo
Scope, price, and what we will not claim.
A fixed-scope review of an AI-built or no-code MVP: authentication and data access, payment webhooks, secrets, and whether the deploy can be repeated. You receive written, ranked findings.