Code Health Review
for AI-Built Applications
Independent review of an application built with Lovable, Bolt, Replit, Cursor or Claude Code, before real users and real money depend on it. On your stack. No rebuild.
Fixed fee · £1,950 +VAT · 7 working days
What a Code Health Review answers
Building with AI means your app can be live in weeks – without anyone having read the code.
Right now, nobody can tell you whether one user can read another’s data, whether a payment can be faked, or whether anyone would notice an outage. In a scan of 1,645 applications built with Lovable, 170 were exposing user data through 303 endpoints. (CVE-2025-48757, May 2025)
This review answers those three questions, grades what it finds and tells you what to change. Access rules are tested with two real accounts and an anonymous visitor, not read and assumed.
Everything in one report
One PDF within seven working days of access, plus a conventions file for your repository.
Verdict & Scorecard
Safe to launch, launch with conditions, or not yet – on one page, with the three reasons behind it and every area graded.
Access Control & Sign-In
Whether one user can reach another’s data. Tested on staging as two real users and an anonymous visitor, not read and assumed.
Payments & Entitlements
Webhook verification and idempotency, trials and refunds, and whether web and app-store subscriptions land on one account.
Server Functions & AI
Authorisation and input validation on every endpoint. Prompt injection, rate limits and hard spend caps on model calls.
Data, Dependencies & Tests
Constraints and migrations, a scan of packages and repository history for exposed secrets, and what your tests actually cover.
Operations
Monitoring, alerting, backups and whether a restore has ever been tried. Plus a recommended alert list and a release checklist.
Personal Data
Where it lives, who else receives it, whether deletion and export work, and under-18 defaults against the ICO Children’s Code.
Prioritised Fixes
Every finding graded by severity with an effort estimate, and a recommended fix written so you can apply it yourself.
Conventions File
AGENTS.md / CLAUDE.md, ready to commit, so your AI tools follow the rules the review found missing on everything you build next.
At the end you have three things: a verdict you can forward, a list in the order it should be fixed, and the rules to stop it coming back.
Anatoly Silko
Founder, Rocking Tech
Code Health Review
The fixes are yours to make – every finding is written so you or your AI tools can apply it. If you would rather we did them, they are quoted separately after the review.
£1,950
-
Written report, PDF, within 7 working days of access
-
Verdict and Code Health Scorecard
-
Findings graded by severity, each with an effort estimate
-
A recommended fix for every finding
-
Conventions file for your AI coding tools
-
Kick-off call and a 30-minute call on the report
-
Optional: iOS and Android apps – £450 +VAT
-
Optional: re-check once your fixes are in – £450 +VAT
Process
NDA and Kick-off
Up to an hour, on a call. You walk me through what you built, then grant read-only access from a short list sent beforehand.
The review
Nothing needed from you. The code is read, your tests are run, and access rules and payment paths are tested with real accounts.
Report and call
The PDF arrives before the call. Thirty minutes to agree what to fix first. Every finding is yours with a fix written so you can apply it.
Seven working days from the day access is complete. About two hours of your time in total.
Who does the work
Anatoly Silko
Founder, Rocking Tech
Building, rescuing and running production software for UK businesses since 2019, most of it side by side with founders - from first prototype to funded platform. The review, the report and the call are the same person. Not subcontracted.
-
MBA, Cranfield School of Management
-
NatWest Accelerator Alumnus 3x
-
Zend & Laravel Certified
-
Rocking Tech - Laravel Partner
-
Association for Competitive Technology - Member
An expert review of code and configuration at a point in time. Not a penetration test, not a certification or compliance sign-off, and not legal advice. No review can guarantee an application will not be breached.
Example finding
Illustrative only.
Access rule permits every signed-in user
- Issue
- A table holding user records has row-level security enabled with a policy of USING (true). The policy passes every automated check, including the platform’s own security advisor. In practice any signed-in user can read every other user’s rows through the public API key, which is public by design.
- Evidence
- Policy definition in the migration history. Reproduced on staging: user A retrieves user B’s records in a single request.
- Effort to fix
- Half a day, including a test that proves it stays fixed.
- Grade
- Critical. Fix before taking further users.
Frequently asked questions
Do I need to rebuild?
Not for this. The review assumes your stack stays, and every finding is written as a fix to the existing code, with no migration. If something genuinely can't be fixed in place, you get the evidence and the decision is yours.
Which stacks are covered?
Apps built with Lovable, Bolt.new, Replit, Cursor, Claude Code, v0, Base44 and Windsurf, and the stacks they produce: React and Next.js, Supabase, Firebase, Convex and Neon, Vercel, Netlify and Cloudflare, Stripe, Paddle and RevenueCat, OpenAI, Anthropic and Gemini.
What access is required?
Read-only access to the repository and the staging environment, plus a test account. No production secrets. Access is revoked and working copies destroyed within thirty days of the report call.
Can I keep building with AI afterwards?
Yes. That is what the conventions file is for. It gives your AI tools the rules the review found missing, so the same faults do not come back.
How is this different from the Discovery Sprint?
The Platform Discovery Sprint is for deciding what to build, before committing £25,000 or more. This is for an app that already exists and is staying on its current stack.
Is this a penetration test?
No, and we don't do those in-house – though we can suggest firms that do. Best booked once the critical and high findings are fixed, so the testers aren't paid to rediscover what you already know about.
How soon can you start?
Usually within a week of the enquiry, subject to access and paperwork.
Book a review call
Twenty minutes on what you have built. You leave with the scope confirmed, a start date, and the list of read-only access needed.