Your AI-built app, attacked on purpose, with the proof and the fix.
Built with Lovable, Bolt, Cursor, Claude or similar? With two test accounts, we try what a stranger would try on your app. Every hole comes with the request that got in and a fix prompt you paste into your AI tool, then we run the attack again.
Not open yet. Join the waitlist to hear when the first spots open.
What gets tried
- 01
One user reads another user's data
Test user B asks for test user A's records by ID, then tries to change them.
- 02
Tables open to anyone
The public key from your page code, used straight against your database.
- 03
Admin routes for normal users
A normal login calling the routes only an admin should reach.
- 04
Keys in the page code
Your app's own keys tried against your app to show what they open. Payment, email and AI keys are reported, never used.
- 05
Users making themselves admin
A normal user editing their own role or plan.
What a finding looks like
From my own test app, with fake data. Logged in as Alice, I changed Bob's invoice.
The request, sent with Alice's login
PATCH /rest/v1/invoices?id=eq.3
{"status": "paid"}What came back
[{"id": 3, "owner_id": "2222…2222", "customer": "Bob Client Fake",
"amount_cents": 99000, "status": "paid", "memo": "BOB PRIVATE invoice"}]The fix prompt
In Supabase, the invoices table lets any logged-in user read and edit
every row (policy using (true)). Drop every policy on invoices that allows
all rows, since policies combine with OR. Then make the select and update
policies owner_id = auth.uid(), add the same with check to update, and show
me a test where user B cannot read or edit user A's invoice.How it works
Show it's yours
A DNS record or a file on the site proves the app is yours. You sign a testing permission before anything runs.
We attack it
On the URL you name, with two test accounts you create. Read-only first, writes only into the test accounts.
You fix it
Each hole comes with its proof and a fix prompt for Claude, Cursor or Lovable.
We try again
The same attack runs after your fix, so you can see it no longer gets in.
Only apps you own, or apps whose owner has given written permission.
Join the waitlist
You hear once, when the first spots open.
Want to try it yourself first?
The free IDOR guide shows how to test your own app with two accounts in about 5 minutes.