AI app audit & hardening
Security audit and hardening for AI-built apps
Built it with Lovable, Bolt, Cursor, Replit or v0? We find what the demo hides, fix it, and get your app ready for real customers and real data.
Sound familiar?
Signs your app needs a second pair of eyes.
- It works in the demo, but you’re not sure it’s safe to put real customers on it.
- A customer or investor sent a security questionnaire you can’t answer.
- Every AI “fix” breaks something else.
- Nobody on the team fully understands the code anymore.
What we check
Eight areas where AI-built apps usually break.
Most issues come from code that works for one user and fails for the next thousand.
- 01
Secrets & API keys
Keys in the frontend, the repository or logs. Separate test and production credentials.
- 02
Authentication
Sign-up, login, password reset, sessions and token handling.
- 03
Access control
Can one customer read or change another customer’s data? We test it instead of assuming it.
- 04
Database rules
Supabase row-level security, Firebase rules and any database exposed to the internet.
- 05
Input & API abuse
Validation, injection, rate limits, file uploads and webhooks.
- 06
Dependencies
Outdated or vulnerable packages, and packages the AI invented.
- 07
Data & privacy
Which personal data you store, where it lives and who can export it.
- 08
Deployment & recovery
Environments, backups, logging, monitoring and rollback.
How it works
Audit, fix, ship.
- Step 1
Audit
We review the code, the database and the live app. You get a plain-English report: what is wrong, how risky it is and what to fix first.
You get: Prioritized findings report
- Step 2
Fix
We fix the critical issues in your own repository, add tests and explain every change.
You get: Pull requests you own
- Step 3
Ship & monitor
We set up environments, backups and monitoring. A senior engineer signs off the release.
You get: Signed-off production release
Why Kentauro
Half human. Half AI. Fully accountable.
We use AI too
That’s why we know where it fails. AI speeds up the fixes; a person reviews every change before it merges.
We run our own product
Bločko, our AI receipt-capture app, is live in production. We answer the same security questions for ourselves.
Your code stays yours
Everything lands in your repository and your cloud account, documented so any developer can take it over.
Want the full picture of how we build? See how we work →
FAQ
Questions we hear before an audit.
Which tools and stacks do you work with?
Apps built with Lovable, Bolt, Cursor, Replit, v0, Windsurf or Claude Code, as well as hand-written code. The stacks we see most are React, Next.js, Supabase, Firebase, Node.js and Postgres.
Do I need to rebuild my app?
Usually not. Most AI-built apps can be fixed in place. If a rebuild would be cheaper than repairs, we tell you before you spend money.
How long does it take?
It depends on the size of the app. After a 30-minute call and a first look at the code, you get a fixed timeline and a fixed price.
What do you need from us?
Read access to the repository, the database settings and the hosting account. We sign an NDA on request.
Will I understand the report?
Yes. Every finding is written in plain English: what is wrong, what could happen, and what to fix first. Technical details are there for your developers.
Is your app ready for real users?
Tell us which tool you built it with. In 30 minutes you’ll know where it stands.