Skip to content

Security for prototypes built with AI tools

Can one customer see another customer's data?

Check the security of your prototype on Supabase or Firebase with eight checks. You see your risk level, what to fix first and a prompt that has your agent check it in your code.

Start the checkOr a 15-minute intro call
Takes 2 minutesPrompt for Cursor and Claude Code
Filip Papranec
Filip Papranec
founder of Digitaliko

Send us your prototype.

A prototype from Lovable or Cursor is a good start, nothing to be ashamed of. Send us a link to the repo and a few words on what the app does. Within 10 working days we tell you straight whether to build on it.

  1. 1We get back to you within two business days with an audit start date. You write directly to the people who build it.
  2. 2Read-only access to the code is enough. We do not touch customer data.
  3. 3You have the verdict within 10 working days of code access, and the first fix as a PR in your repo.

Or a 15-minute intro call

Can one customer see another customer's data? A 2-minute prototype checkA check with a prompt for your agent. Nothing is sent.

Tick only what you have verified. Where you do not know, leave it empty. Below the result is a prompt that has Cursor or Claude Code check it in your code.

A. Data

B. Login

C. Secrets

Have your agent check it

Paste the prompt into Cursor or Claude Code at the project root. The agent changes nothing, it only lists findings with file and line.

Check the security of this project. Do not change anything, only list findings with file and line.
1. Database: does every table have RLS turned on (Supabase) or Security Rules (Firebase) with a rule for the record owner? List tables without rules and rules like "true" or only "auth.uid() is not null".
2. Browser code: find variables with the prefix NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_ and keys in the code. Is any of them service_role, a secret or a key that can write?
3. Every API route, server action and edge function: does it check login and the record owner on the server? Does it take the user ID from the session, not from the request body?
4. Admin actions: does the server check the role, or only hide the button in the UI?
5. Storage: are buckets with customer files public?
6. Repository: are there .env files or keys in it or in its history? Run gitleaks if it is available.
At the end, sort the findings from the highest risk and give the fix for each in one sentence.

We use the form data only to reply to your inquiry. More in our privacy policy.

Frequently asked questions

Which apps is the check for?
For apps built with Lovable, Cursor, Bolt or Claude Code on a Supabase or Firebase database, where customers have their own data.
Does it replace an audit?
No. The check shows the most common open doors. An audit goes through all the code, deployment and backups, and makes the first fix directly in your repo.
Do you store my answers?
No. The check runs only in your browser and nothing is sent. We do not touch your code or data.