00 Pre-raise self-check
Check your app before an investor does.
A free self-check you point at your own app. It runs the checks a buyer’s security review runs first, and tells you where to look.
Reads your code · Never touches your live app · Free, MIT License
not a scanner. not a pentest.
the questions a reviewer asks first.
The invoice URL
tested
Opened it as the
other company: 404
The share link
wrongdoor
Never opened
It checked the one doorthat was locked.
02 Seven questions
Seven questions a buyer’s review asks first.
In founder words, not scanner output. Each one comes back clear, or with the file and line to look at and a one-line why.
Pre-raise self-check · Screen 2 Draft ·
What it checks, in founder words
-
Q1
Open your app in two accounts; open every share link and public page while logged out.
-
Q2
-
Q3
-
Q4
-
Q5
-
Q6
-
Q7
Its on-screen text, word for word.
question 1 you can run tonight, without the skill. section 03.
Why these, in this order
-
Receipt · 200 apps, preprintReceipt · Preprint V4 · 14 Sep 2026
64% of apps
had broken access control, the largest class: 339 of 1,186 findings. Not yet peer-reviewed.
Source Audit of 200 deployed vibe-coded apps, arXiv 2606.23130 arxiv.org (opens in a new tab) -
Receipt · 127 apps, vendor scansReceipt · Vendor scans Jun 2026
47% of apps
on Supabase had row-level security off on a table. Automated scans run by a company that sells audits.
Source Launch Ready Code, “State of vibe code security” launchreadycode.com (opens in a new tab) -
Receipt · The builder’s own docsReceipt · Lovable docs Accessed 20 Oct 202620 Oct 2026
“These tools support secure application development, but they do not replace a thorough security review.”
Source Lovable docs, Security docs.lovable.dev (opens in a new tab)
03 Tonight
Run question one tonight.
You don’t need the skill for this one. Two accounts and your own app. If one account can read the other’s data, that’s a high one.
yourapp.com/invoices/…
Acme Studio · invoices
yourapp.com/invoices/…
Globex Agency · invoices
yourapp.com/share/…
Shared invoice
copy a link from B.
does it open in A?
what does a
stranger see?
Then run your platform’s own security advisor once. It catches the shape, not the logic.
B’s data in A? that’s a high one.
05 Get the self-check
Run it before someone else does.
Point it at your own app. It reads your code, runs your platform’s own security advisor once, and tells you where to look. It doesn’t touch your live app, fix anything, or stand in for a full inspection.
Found a high one? Book a 20-minute call. I’ll tell you what fixing it takes.
- Works in
- Claude Code, in the Claude desktop app, on your own code.
- Never
- Touches your live app or fixes anything for you.
- Yours to
- Copy, change and share, under the MIT License.
Check your inbox.
- Sent to
- the address you entered
- Skill
- Pre-raise self-check
If the download didn’t start, get the file here.
Download the skillOne more thing
Want the newsletter to fit what you read? Say yes and I’ll email you a link. Open it and confirm, and a cookie in that browser lets the site keep a list of the pages you read here, with dates, next to your email, for 13 months. I use the list only to choose what I send you, and I share it with no one. Switch it off any time.
Free to copy, change and share, under the MIT License. It comes with no warranty: read a skill before you run it.
How I use your emailBox not ticked? You get the self-check and nothing else, and your address is deleted after 30 days.
06 Work with me
You checked the first door. I check the rest.
Send one app or repository. You get a written report pack in five working days, at a price set before I start. I do 80 to 90% of the work with my AI skills. My team polishes and tests.
Not ready? Watch the inspections on YouTubeNot ready? Watch on YouTube (opens in a new tab)I read every request myself.
Free, 20 minutes, no code access. For apps with paying users.