Terry Threatt · software engineer & tech lead
Your AI built the app. I make sure it won't leak data — or lose money.
Fixed-price launch audits for apps built with Lovable, Bolt, Replit, Cursor, or Claude Code. I've shipped and sold products on the exact stack your AI used. I verify the two things it can't check about itself: is it secure, and will it actually get paid.
- Fixed price
- No sales call
- Report in days
- Written for founders, not engineers
Your app works. That's not the same as ready.
Lovable, Bolt, Replit, and Cursor are incredible at making things work. They are consistently bad at the same handful of things — and those things only surface when real users (or attackers, or failed credit cards) show up:
Database rules that don't isolate users.
One missing row-level security policy and Customer A can read Customer B's data. This is the #1 finding in AI-built apps.
API keys sitting in your frontend code.
Your Stripe, OpenAI, or Supabase admin keys, visible to anyone who opens dev tools. Attackers find these in seconds.
Billing that silently fails.
No webhook verification means anyone can fake a “payment succeeded.” Unhandled cancellations mean churned users keep full access forever. You don't get hacked — you just quietly don't get paid.
Zero visibility.
No error tracking, no monitoring. When something breaks at 2am, your users know before you do.
You can't ask the AI to grade its own homework. You need a human who's shipped on this stack before.
Hi, I'm Terry.
I'm a software engineer and tech lead who has spent years shipping real products — App Store, Google Play, Chrome Web Store — on Supabase, Stripe, RevenueCat, and Next.js. I've handled production payments, webhook failures, subscription churn, and security reviews on my own apps, with my own revenue on the line. Two of those products were acquired.
I'm not an anonymous audit team, and I'm not a $20K security firm. I'm the senior engineer you'd want looking over your shoulder before you press launch — at a price you can see right now, with a report you can actually read.
See what I've shippedFixed price. Fixed scope. No surprise invoices.
Full detailsLaunch Scan
The fast pass. Automated scanning plus a human hour on the results.
See what's included
Launch Audit
The full manual security review.
See what's included
Most popularLaunch + Revenue Audit
Everything above, plus the audit nobody else does: will your billing actually work?
See what's included
Already launched? Ship Monitor keeps re-scanning every release for $149/mo — details on the audit page.
What a finding actually looks like
How the audit works →Any user can read every customer's data
Your invoices table has row-level security disabled. A logged-in user can query other customers' invoices directly through the API — no hacking required, just curiosity.
Business impact
Total customer-data exposure; a breach-disclosure event before you've even launched.
Fix prompt — paste into your AI tool
Enable RLS on the invoices table and add policies restricting SELECT/INSERT/UPDATE/DELETE to rows where user_id = auth.uid(). Then write a test that confirms user A cannot read user B's invoices.Verify
Log in as a second account and attempt the same query.
Writing
All articlesNovember 15, 2024
Why Vertical AI Is The Next SaaS Wave
Horizontal AI tools are powerful but generic. The next billion dollars will be made by AI built for specific industries — and engineers are perfectly positioned to build it.
October 20, 2024
Building Software While Working Full Time
The honest guide to starting a software business without quitting your job — systems, tradeoffs, and the mental model shifts that actually make it work.
September 10, 2024
The Engineer's Path To Financial Freedom
Software engineers have rare advantages in the wealth-building game — high income, equity, and the ability to create products. Here's how to use them intentionally.
Follow the build
Teardowns of AI-built apps, the security and billing bugs I find, and what it's like building this service in public. Nothing sent that isn't worth reading.
The newsletter is warming up — say hi and I'll add you to the first send.