Fix Service: Fix Pack and Deep Audit
The free scan tells you what's wrong. If you'd rather not fix it yourself, we'll do it: either the issues the scan found (Fix Pack) or a deeper review of your code, database rules and auth (Deep Audit).
Opening soon. No payment is taken now; joining the waitlist is free and doesn't commit you to anything. Prices are planned launch prices in USD.
Sale Launch sale: 20% off through Nov 30, 2026. Payments aren't open yet; join the waitlist before Nov 30, 2026 and the sale price applies to you.
$149 $119 one-time, per app · planned · 20% off through Nov 30, 2026
We fix what the free scan found, for one app.
- Rotate leaked keys with you (you click the provider buttons, we tell you exactly which) and move them into server-side functions or environment secrets
- Security headers: Content-Security-Policy, HSTS, X-Frame-Options/frame-ancestors, nosniff, Referrer-Policy
- Turn off public source maps and remove exposed files such as /.env or /.git
- Supabase Row Level Security: enable RLS and write owner-only policies for up to 10 tables (or Firebase Security Rules for the equivalent collections)
- Delivered as a pull request or patch plus a copy-paste prompt for your AI builder, with a short write-up of every change
- Before/after Unspill re-scan of your live URL
Target turnaround: 48–72 hours after you give access.
Request early access$349 $279 one-time, per app · planned · 20% off through Nov 30, 2026
Goes beyond what a passive scan can see.
- Everything a passive scan can't check: your source code, database rules and storage policies
- Supabase RLS / Firebase rules review, table by table, including storage buckets, views and SECURITY DEFINER functions
- Auth and user-to-user access tests (can user A read or change user B's data?) using test accounts you provide
- API routes, server actions and edge functions: who can call them, and what they let callers do
- Written report with severity, evidence and fix steps (or prompts) for every issue
- A 30-day re-check after you've applied fixes
Target turnaround: about 5 business days after you give access.
Request early accessHow it works
- Run the free scan and join the waitlist below. Pick Fix Pack or Deep Audit.
- When we open, we email you once to confirm scope and price. Nothing is charged before you agree.
- You give limited access: read access to the repo or a project invite, plus test accounts for an audit. Never send secret keys by email or chat.
- We do the work, send the patch or report, and re-scan your live app.
Not sure what you need? Run the free scan first. It's passive, needs no signup, and never touches your database. Want ongoing checks instead? See Monitor.
FAQ
What is the launch sale?
20% off the planned prices through Nov 30, 2026. Payments aren't open yet, so nothing is charged now; the sale price applies to anyone who joins the waitlist before Nov 30, 2026, and we'll confirm it in writing before charging anything.
Do I pay anything now?
No. The service isn't open yet. Joining the waitlist is free, and we'll ask before charging anything.
Do you need my API keys?
No. Never send us secret keys. When a key needs rotating, you do it in the provider's dashboard and we tell you exactly what to click.
Which builders do you support?
Web apps built with Lovable, Bolt, v0, Cursor or Replit, typically on Supabase, Firebase, Stripe and Vercel or Netlify.