Database rules switched off
Tables anyone can read, or change, with the public key every app ships with.
✓Access rules on every table, tested from the outside.
Security · fixes · private AI
Built your app with AI? I find the holes that leak your users' data — and fix them.
200 OK · NO LOGIN NEEDED2,148 rows
{ "email": "emma.k•••@gmail.com",
"phone": "+1 415 ••• 2291",
"message": "can we move my session to friday?" },
{ "email": "daniel.r•••@outlook.com",
"phone": "+44 7700 ••• 812",
"message": "my new address is 14 Oak St, flat 3" },
{ "email": "sofia.m•••@icloud.com",
"phone": "+1 647 ••• 0934",
"message": "please don't share this with my boss" },
{ "email": "j.okafor•••@gmail.com",
"phone": "+1 312 ••• 7716",
"message": "here's the photo of the contract" },
{ "email": "lena.w•••@yahoo.com",
"phone": "+44 7911 ••• 245",
"message": "my results came back, call me" },
{ "email": "mark.t•••@gmail.com",
"phone": "+1 905 ••• 1180",
"message": "the door code is 4•••" },
{ "email": "aisha.b•••@hotmail.com",
"phone": "+1 646 ••• 5527",
"message": "booked for my daughter, she's 9" },
{ "email": "tom.h•••@gmail.com",
"phone": "+44 7456 ••• 390",
"message": "card ending 4•••, is that ok?" },
{ "email": "emma.k•••@gmail.com",
"phone": "+1 415 ••• 2291",
"message": "can we move my session to friday?" },
{ "email": "daniel.r•••@outlook.com",
"phone": "+44 7700 ••• 812",
"message": "my new address is 14 Oak St, flat 3" },
{ "email": "sofia.m•••@icloud.com",
"phone": "+1 647 ••• 0934",
"message": "please don't share this with my boss" },
{ "email": "j.okafor•••@gmail.com",
"phone": "+1 312 ••• 7716",
"message": "here's the photo of the contract" },
{ "email": "lena.w•••@yahoo.com",
"phone": "+44 7911 ••• 245",
"message": "my results came back, call me" },
{ "email": "mark.t•••@gmail.com",
"phone": "+1 905 ••• 1180",
"message": "the door code is 4•••" },
{ "email": "aisha.b•••@hotmail.com",
"phone": "+1 646 ••• 5527",
"message": "booked for my daughter, she's 9" },
{ "email": "tom.h•••@gmail.com",
"phone": "+44 7456 ••• 390",
"message": "card ending 4•••, is that ok?" },
{ "code": "42501",
"message":
"permission denied for table users" }
Exposed
✓ Locked
Before the checkSame request, after the check
For founders and companies building with Lovable, Bolt, Cursor or Replit. And for offices that want AI without sending client files out. One engineer, from the first check to the fix.
No code or passwords to start · reply within one working day
What I solve
Which one is you?
Founders
You built an app with Lovable, Bolt or Cursor.
It works. But can a stranger read your users' emails, messages and photos with one request? Often, yes.
✓I test it like an attacker, close every door, and show you the proof.
Check my app → CompaniesYour team builds tools with AI — on company data.
Sales, finance and ops ship their own apps in an afternoon. Nobody checked who else can open them.
✓I find every AI-built tool, test what's exposed, and lock it down without stopping the team.
Check our tools → OfficesYou want AI, but client files can't leave the office.
Your staff already paste contracts and records into free AI chats — onto servers you don't control.
✓AI on a machine in your office: same help, nothing leaves, every answer shows its source.
See private AI →Also:My AI-built app is stuck at 80%My agency holds my app's keysMy device needs an appI'm a coach and want my own app
How it happens
A weekend build. A Monday email nobody wants to send.
- Friday · 23:40
The app goes live.
Built in a weekend with an AI tool. Sign-up, payments, chat — it all works. Nobody asks who else can read the database.
- Week 6
2,148 people trust it.
They upload photos, type their home address, send messages they'd never post in public.
- Tuesday · 03:12
A stranger opens one link.
No password, no hacking tool. The database answers anyone who asks — because the access rules were never switched on.
- Thursday · 09:00
The email you have to send.
“We're writing to tell you your personal data was exposed…” In the EU you have 72 hours to report it to the regulator.
- Or
One check, before any of this.
I find the open door first, close it, and send you the request that proves it's shut.
What I check, then fix
Four doors AI tools often leave open.
Secret keys inside the app
Payment, email or AI keys anyone can pull out and run up your bill with.
✓Keys moved to the server; the old ones replaced.
No login check on the server
The screen hides other people's data. The server still hands it out.
✓Every request checks who is asking.
Public file storage
Uploaded photos, IDs and documents open to anyone with the link.
✓Private storage with links that expire.
Who does the work
Nine years at sea taught me to find the fault before it finds you.
I'm Oleksii Mykhalchuk. Thirteen years as an electrical and automation engineer — nine of them on ships: radars, satellite links, networks and automation. At sea there's nowhere to send a broken board. You find the fault and fix it, now.
Now I build and run iOS, Android, web and backend apps alone — with real users and real data. I check your app the way I check my own.
13 yrsengineering
9 yrsat sea
4platforms shipped solo
5languages
How it works
From a link to locked.
- 01
Send me the link
Your app, tool or website, and what you built it with. No passwords, no code needed to start.
- 02
I test it like an attacker
From the outside, the way someone would who wants your data: the database, keys, logins and files.
- 03
You get it in plain words — then it's fixed
What's open, how bad it is, and the request that proved it. I fix it, or your developer does — then I test again.
Tell me what you built.
I'll tell you what's open.
No obligation. I read every message myself and reply within one working day.
Questions
Questions people ask
Do you need my code or passwords?
Not to start. The first look is from the outside, the way an attacker would see your app. For fixes you add me to the project, and remove me when we're done.
What do I get from the first look?
What's open, how bad it is, and the exact request that proved it — in plain words. If your app is clean, I tell you that too.
Can you fix what you find?
Yes. I fix it myself, or give your developer the exact list, and then test again so you know the doors are shut.
We're a company, not a startup. Is this for us?
Yes. If people on your team build tools with Lovable, Replit, Cursor or similar on company data, I find those tools, test what they expose and lock them down — without stopping the team from building.
Will anyone else hear what you find?
No. What I find stays between us, and I delete any data I happen to see.
Do you also build apps?
Yes — iOS, Android, web and backend, including apps that talk to devices over Bluetooth or Modbus, and AI that runs on your own hardware.
Where are you based?
Trogir, Croatia. I work remotely in English with clients across Europe and North America.
Writing
Notes from the work
Your app can run AI on the phone now. Here's what that does to the bill.
Since iOS 26 on iPhone and Gemini Nano on Android, an app can run a language model on the user's own phone with no per-request API cost — but only on recent flagship devices, so most apps still need a cloud fallback.
Apple shipped a foldable. Your app has six weeks.
The iPhone Duo opens to 7.6 inches and reaches customers on 23 October. If your app assumed one screen that never changes shape, that assumption now has a delivery date attached.