A written report
Every check marked pass, warning or fail, in plain words.
SummarySample
Client portal · Lovable + Supabase
- Fail
- 3
- Warning
- 2
- Pass
- 5
- Fixed
- 3
For client portals built with Lovable, Bolt or ReplitFor client portals built with Lovable, Bolt or Replit
Built a client portal with AI? Make sure client A can't see client B.Built a client portal in Lovable? Make sure client A can't see client B.
I test your portal with two client accounts and fix the 3 problems most likely to cost you clients, starting with leaks.
In 2025 the Tea app left about 13,000 ID photos in an open storage bucket.
- 3 real fixes or your money back
- Customer data stays in your app
- Nothing goes live without your OK
- Lovable
- Bolt
- Replit
- v0
- Cursor
- Supabase
- Stripe
Launch Check reportSample
Client portal · Lovable + Supabase
- FailPer-client rules: Client B can open client A's invoices by idFixed: own records only
- FailFiles: Contracts in a public bucket, links never expireFixed: private, expiring links
- FailSign-up: Anyone can register, portal meant to be invite-onlyFixed: invite-only
- WarningMessages: Notification emails include the full messageIn the report
- PassSecrets: No secret keys in browser codePass
Who you're hiring
“AI gets you to a demo in a weekend. I make sure it survives its first paying customer.”
- 15+profitable projects I run myself
- 10checks on your live app
- 3problems fixed, not just listed
- 48 hfrom access to your report
What it is, and why it matters
A client portal holds the things clients trust you with most: contracts, invoices, files, messages. In an AI-built portal, what keeps one client's records away from another's is a set of database and storage rules the builder wrote for you. They often work for one test client and fail for the second, and no client will tell you. They'll just stop trusting you.
- One client opens another client's invoice or file by changing a number in the address bar.
- Anyone who finds the sign-up page can create an account and look around, because the portal was meant to be invite-only.
- A client asks "is my data safe with you?" and you have nothing in writing to show them.
- In 2025 a researcher scanned 1,645 Lovable apps and found 170 with customer data readable by anyone (CVE-2025-48757).
- Under GDPR, exposing clients' personal data can bring fines of up to €20 million or 4% of annual turnover.
How I fix it
- Per-client data rules on every table, so each client reaches only their own records, tested with two real accounts.
- Private file storage with links that expire, and only for the client the file belongs to.
- Invite-only sign-up, and a written summary you can send a client who asks how their data is protected.
Same $299 Launch Check, same guarantee: 3 real fixes or your money back.
What you get in 48 hours
A 10-minute video
Me walking through your app and the report, finding by finding.
The 3 most costly problems, fixed
Usually customer data open to other users, payments that leak money and exposed keys. If one is already fine, I fix the next most serious one. In your repository, as changes you approve.
Your key-rotation list
Every exposed secret, where to rotate it, and in what order.
Your 48 hours, step by step
Minute0
You pay $299
Card or wallet, via Stripe.
Minute5
You give me access
Collaborator access. No GitHub? I'll walk you through it.
Hour1
I check all ten
On your live app.
Hour48
Report, video, 3 fixes
In your inbox and repo.
Day14
Your call
Stop, or Sprint with $299 off.
Your part takes about 7 minutes. Mine takes the rest.
Lock down my portal, $2993 real fixes or your money back.
Launch Check
Fewer than 3 real problems found and fixed: the full $299 back. You keep the report.
Sprint
Not live 5 working days after access: the full $1,090 back.
I won't call your app “secure”. Nobody honestly can. You get what I checked, fixed and left open, in writing. Refund policy
Why not just ask the AI, or hire a freelancer?
| What matters | Launch Check with me | Ask the builder's AI | A report-only audit | Hire a freelancer |
|---|---|---|---|---|
| Problems fixed, not just listed | Top 3 fixed in 48 hours | Sometimes | No | Yes |
| Price known before you start | $299, fixed | Credits, until it works | Yes | Usually hourly |
| Checks your live database and Stripe, not just the code | Yes | Partly (code and RLS lint) | Depends | Depends |
| Keeps your builder and your code | Yes, no rewrite | Yes | Yes | Often quotes a rewrite |
| Money back if it doesn't deliver | Yes | No | Depends | Depends |
| Me | Builder AI | Audit only | Freelancer |
|---|---|---|---|
| Problems fixed, not just listed | |||
| Top 3 fixed in 48 hours | Sometimes | No | Yes |
| Price known before you start | |||
| $299, fixed | Credits, until it works | Yes | Usually hourly |
| Checks your live database and Stripe, not just the code | |||
| Yes | Partly (code and RLS lint) | Depends | Depends |
| Keeps your builder and your code | |||
| Yes, no rewrite | Yes | Yes | Often quotes a rewrite |
| Money back if it doesn't deliver | |||
| Yes | No | Depends | Depends |
Who this is for
This is for you if
- Your app works, and you're about to take payments or real user data.
- You launched, and something feels off.
- You don't write code and want it explained plainly.
It's not for you if
- You want a full rewrite or a native mobile app.
- You can't share access to the code and the database.
- Your app stores health records or card numbers itself.
Start with $299. Then stop, or finish the job.
Why so cheap? It's how I find Sprint clients, so it has to be worth $299 on its own, even if you never hire me again.
Most people start here
Launch Check
$299
One payment, report in 48 hours
- All ten areas checked on your live app
- Written report and a 10-minute video
- The 3 most costly problems fixed: usually customer data, payments and keys
- 3 real fixes or your money back
- Card, Apple Pay or Google Pay, via Stripe
- Collaborator access, never passwords
- Every fix is a change you approve
- I never copy or export your customers' data
- Data processing agreementRefund policy
Then, if you want it all doneShip-it Sprint: everything on the list fixed, live in 5 working days.
$791 after your Check
What the Sprint coversPrices in US dollars. App down or data leaking right now? Rescue, $490: I start within 24 hours.
Test your portal yourself
- Create two test clients. Sign in as the first, upload a file and open an invoice. Then sign in as the second and try the same addresses.
- Open a file link in a private browser window, signed out. If it opens, anyone with the link can download it.
- Visit your sign-up page signed out. If anyone can register, the portal isn't invite-only.
Only ever check an app you own or have written permission to test.
Found something you'd rather not fix yourself?
Have me fix it, $299Questions
Still unsure? Email me. I reply within a few hours on working days.[email protected]
What does client portal data privacy come down to?
Three things: each client reaches only their own records, files are private with links that expire, and only invited people can sign up. Those are the client portal data privacy checks I run first.
Can I show the report to my clients?
Yes. The report is yours, and the summary is written so you can send it to a client who asks how their data is handled.
My portal uses Supabase storage for files. Is that covered?
Yes. Storage rules and file links are part of the ten checks, alongside the database rules.
Do you fix everything for $299?
I fix the 3 most costly problems: usually customer data, payments and keys. Everything else is written up with how to fix it. Want all of it done? The Ship-it Sprint fixes everything on the list in 5 working days, and your $299 counts toward it.
I've never connected GitHub. Is that a problem?
No. I'll walk you through connecting it from Lovable, Bolt or Replit. It takes a few minutes, the repository is yours, and you keep editing in your builder as before.
Is it safe to give you access?
You add me as a collaborator on GitHub, Supabase and your hosting, so you can see everything I do and remove me in one click. I never ask for passwords, I don't copy your customers' data anywhere, and when I'm done you get a list of keys to rotate.
What if you don't find much?
If I can't find and fix at least 3 real problems, you get the $299 back. You still keep the report, which shows what was checked and passed.
What if my app is a mess?
Then a Check is the cheapest way to find out how much of a mess. The report says plainly whether it's worth fixing, and if a rewrite is the honest answer, it says that too, before you spend more.
Will you rewrite my app or make me leave my builder?
No. I fix what's there, in your repository. You keep building in Lovable, Bolt or Replit afterwards, and the report tells you what not to undo.
Who does the work?
I do, myself, every check and every fix. That's why there are only three Sprint slots a week.
Is this a penetration test?
No. I check your app's setup against a fixed list, on your own accounts, and fix what fails. I don't attack your app or anyone else's, and I won't call it "secure": you get in writing what was checked, what was fixed and what's still open.
Where are you, and how fast do you reply?
I work from Europe (CET) and reply to email within a few hours on working days. The 48 hours of a Launch Check start when I have access; a Rescue starts within 24 hours of access, any day.
What happens after the Launch Check?
Nothing, unless you want it to. The report is yours to fix the rest yourself or with anyone. If you book the 5-day Sprint within 14 days, the $299 comes off its price.
Find the holes before your customers do.
$299, 48 hours, and the 3 most costly problems fixed in your repository: usually customer data, payments and keys. 3 real fixes or your money back.
- 3 real fixes or your money back
- Never asks for passwords
Launch Check, $2993 real fixes or your money backLock down my portalFix my top 3