USE CASE · PASSING SECURITY REVIEW
A customer sent a security questionnaire you cannot answer honestly.
The situation
Security review is where a lot of promising deals stall. The questions are rarely about features. They ask who can see what, what gets logged, where data sits at rest, and what happens on the day something goes wrong. A founder who built with AI tools usually knows the honest answer is "nothing yet", and the questionnaire has no box for that.
What breaks
Admin routes guarded in the interface but not in the API, so the guard disappears for anyone who calls the endpoint directly. One shared key used by every integration, impossible to rotate without taking the product down. No audit trail, so there is no way to say who changed what. Personal data stored in the clear.
PRODUCTION READINESS REPORT
AUDIT NO. 0147 · AUG 2026
Anon key with write access in the clientCRITICAL
Auth checked in the UI, not in the APICRITICAL
No rate limiting on any endpointCRITICAL
Schema edited live, no migrationsNEEDS ATTENTION
Logging is console.log onlyNEEDS ATTENTION
An illustrative finding set for an AI-built export. All fixable in 4 weeks.
ILLUSTRATIVE · NOT A CUSTOMER REPORT
totally normal for AI-built apps — fixable, here's the plan →
What we do about it
STEP 01 · FREEAudit the repoRead-only access, and 48 hours later you have a graded report: everything standing between the prototype and production, ordered by risk and priced.STEP 02 · FIXED PRICEProductionize itWe keep the UI and the flows your users already validated, and make everything underneath them production-grade.STEP 03 · OPTIONALKeep it healthyMonitoring, patches, and a steady lane of improvements each month until you have your own team. Cancel any month.
What the questionnaire is asking for
- 01Authorization enforced in the API, never only in the interface
- 02Roles and permissions you can describe on one page
- 03An audit trail over anything that touches customer data
- 04Secrets in a manager, rotatable without downtime
- 05A written incident process, because they will ask for it
MORE USE CASES