Max Zeshut

$299report in 48 hours

White-label audits of AI-built apps

For agencies: inherited a client's AI-built app? I audit it under your name.

For your client's app: I fix the 3 problems most likely to cost them money or customers, check all 10 areas, and write up the rest in a report you can send under your own name. 48 hours.

Check a client app for $299Who I am and what I do
  • 3 real fixes or your money back
  • Report under your name
  • Your client's data never leaves their app
  • Lovable
  • Bolt
  • Replit
  • v0
  • Cursor
  • Supabase
  • Stripe
Launch Check reportSample

Client's app · Replit + Postgres + Stripe

  • FailDatabase rules: Every user can read every customer's ordersFixed in the client's repo
  • FailSecrets: Stripe secret key in browser codeFixed, key on the rotation list
  • FailPayments: Webhook accepts unsigned requestsFixed in the client's repo
  • WarningBackups: Never restored, files not coveredIn the report
  • PassDomain: HTTPS on, redirects correctPass

Who you're hiring

“AI gets you to a demo in a weekend. I make sure it survives its first paying customer.”
Max Zeshut, building software for almost 10 years, Europe (CET)LinkedIn[email protected]About me
  • 15+profitable projects I run myself
  • 10checks on your live app
  • 3problems fixed, not just listed
  • 48 hfrom access to your report

What it is, and why it matters

Clients now arrive with apps they built in Lovable, Bolt or Replit, and ask your agency to take them over. Before you quote, you need to know what you're inheriting: whose data is exposed, which keys are in the browser, whether payments really unlock on payment. I check that for you, fix the worst of it, and write it up so you can hand it to the client as your own.

  • You quote for new features, then find the database open to every user, and the fix comes out of your margin.
  • A leak after you take over becomes your agency's problem, whoever wrote the code.
  • Reviewing AI-written code yourself takes your developers away from billable work.

How I fix it

  • The ten checks on the client's live app, with a report in plain words you can rebrand and send.
  • The 3 most costly problems fixed in the client's repository, as changes you approve.
  • A fixed price per app, and pricing for several apps on request.

Each app is a $299 Launch Check. For three or more, email me and I'll quote a fixed price for all of them.

Check a client app for $299

What you get in 48 hours

A written report

Every check marked pass, warning or fail, in plain words.

SummarySample

Client's app · Replit + Postgres + Stripe

Fail
3
Warning
2
Pass
5
Fixed
3
Ten areas, each with what it means for your customers and what it takes to fix.

A 10-minute video

Me walking through your app and the report, finding by finding.

The 3 most costly problems, fixed

Usually customer data open to other users, payments that leak money and exposed keys. If one is already fine, I fix the next most serious one. In your repository, as changes you approve.

Your key-rotation list

Every exposed secret, where to rotate it, and in what order.

Your 48 hours, step by step

  1. Minute0

    You pay $299

    Card or wallet, via Stripe.

  2. Minute5

    You give me access

    Collaborator access. No GitHub? I'll walk you through it.

  3. Hour1

    I check all ten

    On your live app.

  4. Hour48

    Report, video, 3 fixes

    In your inbox and repo.

  5. Day14

    Your call

    Stop, or Sprint with $299 off.

Your part takes about 7 minutes. Mine takes the rest.

Check a client app for $299

3 real fixes or your money back.

Launch Check

Fewer than 3 real problems found and fixed: the full $299 back. You keep the report.

Sprint

Not live 5 working days after access: the full $1,090 back.

I won't call your app “secure”. Nobody honestly can. You get what I checked, fixed and left open, in writing. Refund policy

Why not just ask the AI, or hire a freelancer?

Launch Check with meAsk the builder's AIA report-only auditHire a freelancer
Problems fixed, not just listedTop 3 fixed in 48 hoursSometimes
Price known before you start$299, fixedCredits, until it worksUsually hourly
Checks your live database and Stripe, not just the codePartly (code and RLS lint)DependsDepends
Keeps your builder and your codeYes, no rewriteOften quotes a rewrite
Money back if it doesn't deliverDependsDepends
MeBuilder AIAudit onlyFreelancer
Problems fixed, not just listed
Top 3 fixed in 48 hoursSometimes
Price known before you start
$299, fixedCredits, until it worksUsually hourly
Checks your live database and Stripe, not just the code
Partly (code and RLS lint)DependsDepends
Keeps your builder and your code
Yes, no rewriteOften quotes a rewrite
Money back if it doesn't deliver
DependsDepends

Four of the projects I run, live right now

This is for you if

  • Your app works, and you're about to take payments or real user data.
  • You launched, and something feels off.
  • You don't write code and want it explained plainly.

It's not for you if

  • You want a full rewrite or a native mobile app.
  • You can't share access to the code and the database.
  • Your app stores health records or card numbers itself.

Start with $299. Then stop, or finish the job.

Why so cheap? It's how I find Sprint clients, so it has to be worth $299 on its own, even if you never hire me again.

Most people start here

Launch Check

$299

One payment, report in 48 hours

  • All ten areas checked on your live app
  • Written report and a 10-minute video
  • The 3 most costly problems fixed: usually customer data, payments and keys
  • 3 real fixes or your money back
Check a client app for $299
  • Card, Apple Pay or Google Pay, via Stripe
  • Collaborator access, never passwords
  • Every fix is a change you approve
  • I never copy or export your customers' data
  • Data processing agreementRefund policy

Then, if you want it all doneShip-it Sprint: everything on the list fixed, live in 5 working days.

$791 after your Check

What the Sprint covers

Prices in US dollars. App down or data leaking right now? Rescue, $490: I start within 24 hours.

Before you take the app on

  1. Ask the client for collaborator access to the builder, the database and Stripe. Never ask for passwords.
  2. Sign up twice in the client's app with two test accounts and check whether either can see the other's data.
  3. Search the code for keys that start with sk_ or service_role. Any found in browser code are exposed.

Only ever check an app you own or have written permission to test.

Found something you'd rather not fix yourself?

Have me fix it, $299

Questions

Still unsure? Email me. I reply within a few hours on working days.[email protected]

Do you contact our client?

Only if you want me to. By default I work through you: access comes from you, the report goes to you, and you decide what the client sees.

Can the report carry our branding?

Yes. It's written without my name in it, so you can send it on your own letterhead.

Do you fix everything for $299?

I fix the 3 most costly problems: usually customer data, payments and keys. Everything else is written up with how to fix it. Want all of it done? The Ship-it Sprint fixes everything on the list in 5 working days, and your $299 counts toward it.

I've never connected GitHub. Is that a problem?

No. I'll walk you through connecting it from Lovable, Bolt or Replit. It takes a few minutes, the repository is yours, and you keep editing in your builder as before.

Is it safe to give you access?

You add me as a collaborator on GitHub, Supabase and your hosting, so you can see everything I do and remove me in one click. I never ask for passwords, I don't copy your customers' data anywhere, and when I'm done you get a list of keys to rotate.

What if you don't find much?

If I can't find and fix at least 3 real problems, you get the $299 back. You still keep the report, which shows what was checked and passed.

What if my app is a mess?

Then a Check is the cheapest way to find out how much of a mess. The report says plainly whether it's worth fixing, and if a rewrite is the honest answer, it says that too, before you spend more.

Will you rewrite my app or make me leave my builder?

No. I fix what's there, in your repository. You keep building in Lovable, Bolt or Replit afterwards, and the report tells you what not to undo.

Who does the work?

I do, myself, every check and every fix. That's why there are only three Sprint slots a week.

Is this a penetration test?

No. I check your app's setup against a fixed list, on your own accounts, and fix what fails. I don't attack your app or anyone else's, and I won't call it "secure": you get in writing what was checked, what was fixed and what's still open.

Where are you, and how fast do you reply?

I work from Europe (CET) and reply to email within a few hours on working days. The 48 hours of a Launch Check start when I have access; a Rescue starts within 24 hours of access, any day.

What happens after the Launch Check?

Nothing, unless you want it to. The report is yours to fix the rest yourself or with anyone. If you book the 5-day Sprint within 14 days, the $299 comes off its price.

Find the holes before your customers do.

$299, 48 hours, and the 3 most costly problems fixed in your repository: usually customer data, payments and keys. 3 real fixes or your money back.

  • 3 real fixes or your money back
  • Never asks for passwords
Check a client app for $299Not ready? Take the free 3-minute scorecard
Launch Check, $2993 real fixes or your money backCheck a client appFix my top 3