Open to anyone with the link
The tool went live on a public address. No company login, so a forwarded link is all it takes.
✓Every tool behind your company sign-in (Google, Microsoft or SSO).
For companies whose staff build with AI
Your staff build apps with Lovable or Replit. Who else can open them?
Commission calculatorSales · Lovable Public link✓ Company login
Invoice trackerFinance · Replit Customer data open✓ Company login
Candidate pipelineHR · Base44 CVs in public storage✓ Company login
Order lookupSupport · Bolt API key in the page✓ Company login
4 of 4 open
✓ Locked
Sales, finance and HR now ship their own apps in an afternoon. Nobody in IT knows they exist, and many are open to anyone with the link. I find every one, test it like an attacker, and lock it down. The team keeps building.
Check our tools Reply within one working day · NDA on request
What I find in team-built tools
Four doors nobody meant to open.
Company data copied out
Customer lists, salaries or CVs exported into a new database outside your systems, with its rules switched off.
✓Access rules on every table, tested from the outside.
Company keys in the code
CRM, payment or AI keys pasted into the app, where anyone can read them and run up your bill.
✓Keys moved to the server, the old ones replaced.
Nobody owns it
The person who built it moves on. The tool keeps running on a personal account, and nobody updates it.
✓A list of every tool with an owner, an account and a plan.
How it works
Lock it down. Keep the team building.
- 01
Tell me what you suspect
Your company site and the tools people use. No passwords and no code needed for the first look.
- 02
I find and test every tool
From the outside first, the way an attacker would. Then with read-only access: who built what, which data it holds, who can open it.
- 03
You get a plain list, then fixes
Each tool: what's open, how bad it is, the proof. I fix it or your team does, then I test again. Plus a one-page rule so the next tool starts safe.
Tell me about your team.
I'll tell you what's open.
No obligation. I read every message myself and reply within one working day.
Will you stop our people from building?
No. The point is to keep the speed and close the doors: company login, private data, keys on the server, and a short rule for the next tool.
Do you need admin access?
Not to start. The first look is from the outside. For the full list I ask for read-only access to the workspaces your team uses, and you remove me when we're done.
We already have IT and a security team.
Good, I work with them. Scanners and yearly pen tests rarely see tools built last week on a personal account; that gap is what I cover.
Will you sign an NDA?
Yes. What I find stays between us, and I delete any data I happen to see.
Which tools can you check?
Web and mobile apps built with Lovable, Replit, Cursor, Bolt, Base44, v0 or by hand, on Supabase, Firebase, Vercel, Netlify or your own servers.