What we check
What does a shakedown check?
A shakedown checks the things AI-built apps keep shipping with — exposed keys, open data and broken access — across the whole app, not just the code. Every finding is written in plain English — what it is, what goes wrong if you don't fix it, and the fix — so you know exactly what to do. It also checks the clean-up that makes your codebase cheaper for AI to keep working in, and ready for your first engineering hire. The point is to find the failures before launch, when they're cheap to fix.
Exposed keys
API keys, tokens and secrets that ended up in the client bundle, the repo, or the repo history. These are the findings that turn a "vibe-coded app got hacked" story into yours.
If not fixed
What we look for
- Keys and tokens in the client bundle or env files
- Secrets committed to the repo, including history
- Service-account and admin credentials in the code
What you get back
- Each key named, ranked, and shown where it lives
- A fix your own AI can apply — rotate, move, restrict
- A note on how it got there, so it does not come back
Open data
Records any visitor can read or write. We check the access rules, not just the code — because the rule is what decides whether a stranger can list every row.
If not fixed
What we look for
- Tables and rows readable or writable by anyone
- Missing ownership checks (IDOR) on records
- Admin or internal data reachable from the client
What you get back
- What is exposed, shown as the path a stranger would take
- The access rule to add, written so your AI can apply it
- A re-check so the fix holds
Broken access
Routes and actions that skip the check. We trace the path a stranger would take — from the outside in — and close the ones that are open.
If not fixed
What we look for
- Admin routes and actions reachable without a role
- Payments and webhooks trusted from the client
- Actions that skip the ownership or role check
What you get back
- Each open path, ranked by what it would let a stranger do
- The check to add, as a fix your AI can apply
- A note on the pattern, so the next one is caught early
No source control
The code has no version control — no git history, and no remote backup. The only copy is the one running in production.
If not fixed
What we look for
- No git history, or no remote backup at all
- Code that lives only on the hosting server
- No way to roll back a change
What you get back
- A git repo with a remote backup, set up for you
- A rollback story your AI can work within
- A note on how to keep it that way
Things exposed to the public that shouldn't be
Things wired to the public that were never meant to be there — database admin interfaces, test and debug endpoints, staging consoles, seed data left reachable in production, and anything a founder forgot was on the public.
If not fixed
What we look for
- Database admin interfaces (phpMyAdmin, Adminer, Mongo/Atlas admin UIs)
- Test and debug endpoints left routable
- Staging consoles and seed data reachable in production
What you get back
- Each exposed thing named, with the URL a stranger would use
- The fix to take it off the public internet
- A re-check so it stays down
The failures this is built to catch
Named, so you know what you're insuring against
These are the specific, named failures a shakedown is built to find before launch — and what each one costs after.
Exposed credentials
An API key, token or service-role secret in the client bundle, the repo, or the repo history.
After launch: anyone can read it and use it to read or write your whole database. Lost data, lost trust.
Missing auth or RLS
A table with no row-level security, or a route that skips the ownership or role check.
After launch: any visitor can list every record, including other people's. Lost data, lost trust, the public postmortem.
Prompt injection in your own AI feature
Your app's AI feature takes input from a stranger, and that input is a door into your data and your actions.
After launch: a stranger drives your feature against your data. Downtime, lost trust.
A wiped database
No version control, no backup. One bad migration, or one bad actor.
After launch: your data is gone for good. Lost data, downtime.
Engineer ready
And the clean-up that comes with it
A shakedown also checks the clean-up that makes your codebase cheaper for AI to keep working in — and ready for your first engineering hire. Tangled code is the thing that makes every later change cost more, in AI tokens and in a new hire's first weeks.
A real, principal software engineer reviews what the AI built. The tools did their job; this is the step every serious company takes before real users, payments or investors depend on it.
See what a report looks like
A sample report, from a fictional app — ranked findings, each written in plain English with a fix your own AI can apply.