How much does my app cost to run?

A typical AI-built app spends money in three places: React/Vite or Next.js on the front, Supabase or Firebase on the back, and an LLM API for the smart parts. Each has a failure mode that turns it into a bill you did not budget for. The tools did their job, and the product is fine. These are the costs the app carries on its own. A shakedown looks for exactly these.

• Runaway infrastructure bills: unbounded compute and storage. The serverless function that answers each request, and the database, object store and logs that grow with usage. The failure mode is a request that costs more than it should, or a write that never stops. A heavy query or a paid call on every hit with no limit. A table that fills with duplicates. An upload endpoint that accepts files of any size.
• Unguarded paid API calls: the LLM, the email provider, the payment processor, the image API, metered per call. The failure mode is a paid call a stranger can trigger without paying for it. An unauthenticated endpoint that calls the LLM or sends an email. A generation loop a user can re-trigger without limit. A public endpoint with no rate limit that a single visitor can pull as hard as they like.
• Lost or leaked customer information: the data you are holding for your customers. The failure mode is access that is wider than it should be. An API key or secret in the client bundle or the repo. A table any visitor can read or write. A route that skips the ownership check. This is the one that costs more than money. It is the customer data and the trust that comes with it.

The numbers are illustrative ranges for a typical AI-built app, not a quote. Your app's real number depends on its size and its traffic. That is why the shakedown is quoted up front for the size of your app.

A shakedown traces the routes the way a stranger would, and looks for each of the three in your app. What it hands back is the list of things that would have cost you money. Each is named, shown where it lives, and paired with a fix your own AI can apply.

• The runaway bills: every route that can run unbounded compute or storage, and the cap, alert or rate limit that stops it before it surprises you.
• The unguarded paid calls: every route that makes a paid call, and whether it is reachable without authentication or an ownership check. Plus the per-user cap that keeps it bounded.
• The open customer data: every key, table and route, and whether a stranger can read or write what should be private.

The full list of what is checked, and what you get back for each, is on the what we check page.

You read the price against what it stops. The Full Shakedown is from AUD 1,500, quoted up front for the size of your app and fixed once agreed. What it stops runs every month, for as long as it is open. An unguarded paid call or an exposed key keeps costing you. A leaked customer dataset is the cost you do not get back. A typical app runs from a few dollars a month at low traffic to hundreds once real people arrive. Left open, the unguarded calls and the open data are what push that into the thousands a month.

You get back a ranked list of the cost exposures. Each is named, shown where it lives, and paired with a fix your own AI can apply. You also get the cost model: what to expect at each level of usage, and the alerts and caps to set before you launch. You can see the shape of it in the sample report. It is from a fictional app, and it says so.