Services · AI App Review

Your team built it with AI coding tools. Has anyone outside the team read the code?

AI coding tools let a small team build in weeks what used to take months. They also write code that looks finished and passes the demo while skipping the checks a careful engineer adds by habit. I spend two full days in your code, by hand, and tell you what I find.

“Found security gaps I wouldn't have caught on my own.”

Dar, founder · Google review

Request an AI App Review See what I look for

$1,500, one time. Two days in your code, a ranked report, and a 90-minute walkthrough.

The people who built it are the worst placed to see what it assumes

This isn't a grade on your team. An outside read exists for the same reason writing has editors. AI-assisted code makes the gap wider: the tool writes what you asked for and stops there. Server-side validation, authorization checks on every record, timeouts on outside calls, and error handling for the inputs nobody tested are the parts it tends to leave out, and they're also the parts a demo never exercises.

I've spent 30 years building and running production software, and these days I spend a lot of my own time having AI write code. It does its best work on the happy path, where the user enters the right thing, the outside service answers, and the data is clean. Real users leave that path constantly, and that's where I keep catching what it missed. I read code the way I would if I had to maintain it, and I run the app myself to try the inputs a real user eventually will.

The code looks professional, and that's exactly why nobody checks it. "It works" usually means "it worked in the demo."

What I look for

Four areas, read and run by hand. Not a linter scan.

Security

Secrets and API keys reachable from the browser or the repo. Records any signed-in user can read or change by editing an ID. Login, signup, and password reset that can be brute-forced or used to find out who has an account. Input that reaches the database, the page, or the disk without being checked.

Performance

Queries filtering or joining on columns with no index. Outside API calls and database queries with no timeout. List endpoints with no pagination or limit. Anything that works with fifty rows and stalls at fifty thousand.

Stability

Unhandled errors and silent failures. Raw error pages and stack traces shown to users. Validation that only lives in the browser. Whether anyone would know if it broke tonight.

Data integrity, email, and domain

Prices and calculations the server trusts from the browser. Limits and quotas that hold on one path into the data and not the next. Whether your domain's email can be spoofed. Whether the services you depend on are set up the way you think they are.

What $1,500 includes

$1,500, one time, invoiced by Klass Concepts LLC when the report is delivered. Fixing what I find is quoted separately once we both know the scope, and only if you want me to do it. Your own team can take the report and run with it.

Send me access

After we talk: read-only access to the repo, or a zip export if that's easier, a way to run the app, and a few sentences on what it does and who uses it.

Two full days in your code

Reading it, running it, and trying the inputs a real user eventually will. We schedule the two days together once access is set up.

A written report, ranked

What to fix now, what to fix soon, and what's fine to leave. Every finding is something I found by hand, with the steps to reproduce it and the reasoning behind it.

A 90-minute walkthrough

In person or by video, with you and your team, going through every finding.

What a finding looks like in the report

Every finding is written up the same way: what's wrong, how to see it yourself, why it matters, and what to change. This one is the record-cap bypass from the CRM case study below, written up the way the report would present it.

Fix now

The free plan's record limit can be bypassed by restoring deleted records

What I found

Creating a record at the 50-record limit is blocked. Restoring a deleted record at the same limit isn't checked, so the account can go past the cap.

How to reproduce

Bring a free account to 50 records, with a few deleted records in the recycle bin.
Try to create a 51st record. It's blocked, as expected.
Restore the deleted records from the recycle bin. They're all restored, and the account goes past 50 (to 58 in my test).

Why it matters

The limit is what separates the free plan from the paid one. Any path into the data that skips the check gives away the paid tier's capacity, and the next path someone adds (an import, an API, a merge) will likely skip it too.

What to change

Enforce the limit in the one place every write goes through, not in the create handler, so create, restore, import, and anything added later all hit the same check. Then add a test for each path.

Case Studies

What a few hours of looking turned up

Both of these were short, informal passes done as favors: a few hours of using each app from the outside, before any code review. A full AI App Review goes much further.

A CRM in closed beta

Three crashes, a record cap that a restore could walk straight past, and quotes that saved with any price you typed. Read the case study

A beverage community app

A "private" setting that didn't always hold, and form rules the server never enforced. Read the case study

See one finding: a record limit with a second way in

This is one of the things I found in that CRM, rebuilt in a small demo app so I'm not showing anyone's real product. It's 80 seconds long.

Is this a fit?

A good fit if

Your team builds with AI coding tools and nobody outside the team has read what they wrote
You're about to put real users, real money, or another company's data through it
A customer's security questionnaire, a pilot, or a fundraise is coming up and you want to know first
You want a ranked list of what to fix, not a 40-page audit nobody reads

Not a fit if

You want a guarantee the app has zero problems; nothing can promise that
You need a penetration test or a compliance certification; this is a by-hand engineering review, not either of those
You need ongoing technical leadership rather than a one-time review; see the Fractional CTO Retainer
You haven't built anything yet; that's a different conversation, book a call

What I've written about these gaps

Notes from my own systems, where I found the same kinds of problems I look for in yours.

Oct 17, 2026

Filtering the Menu Is Not Enforcement

A set of tools was excluded from what the model gets offered, with a doc comment explaining the hazard. Nothing stopped the model from calling them anyway.

Oct 7, 2026

A Test That Guards Nothing While Looking Like It Does

The test everyone would point at to answer "what stops a restricted key holding a dangerous permission" had hardcoded a copy of the list it was supposed to be guarding.

Sep 26, 2026

The Overwrite Nobody Asked For

An audit of my own file-writing tools found three separate ones that would silently destroy an existing file, all with the same shape, none of them intentional.

Sep 9, 2026

The Single-Instance Race Nobody Tests For

Checking a list of running processes to prevent a second launch has a race condition baked into how you'd naturally test it: one launch at a time.

Jul 8, 2026

Have AI Review AI: Building a Verification Loop You Can Trust

Why the first thing a model produces is a draft, and how to build a separate adversarial review pass with a clean context that catches what the generator missed.

Questions

Is this a security audit or a penetration test?

No. It's two days of an experienced engineer reading and running your code by hand. It covers security, but it isn't a formal audit, a pen test, or a compliance certification, and the report doesn't claim to be one.

What do you need from me?

After we talk: read-only access to the repo (GitHub, GitLab, or a zip export), a way to run the app, and a few sentences on what it does and who uses it. Please don't send credentials through the form.

Do you keep my code?

No. I keep it only until the walkthrough is done, then delete my local copy. I'll sign an NDA if you'd like one.

Can you fix what you find?

Yes, if you want me to. Fixes are quoted separately once we both know the scope. The review price doesn't include them, and you're free to have your own team do the work.

What if I don't have a developer background?

The report is written so a founder can act on it, with plain explanations of what's wrong and why it matters, and the technical detail your developers need to fix it.

Who do I pay?

Klass Concepts LLC, my company. The agreement and the invoice come from Klass Concepts, and I do the review myself.

What can't two days find?

A review finds what two careful days can find. It can't promise the app will never fail, and nothing can. What it does give you is a ranked list of real problems, each one reproduced, before a user or an attacker finds them.

Request a review

Tell me what you'd like reviewed.

I'll follow up to talk through the app and arrange access. This form requests the work; it doesn't book or charge anything.