Your app works. That doesn't mean it's safe to ship.
You built it fast. The frontend looks good, the features work, users can sign up. The backend got written by an AI at 1am and nobody has read it since.
That's the part I look at.
The problem with shipping fast
Nothing about a broken backend announces itself. Your app doesn't slow down. It doesn't throw errors. It works exactly the way it's supposed to, right up until someone opens devtools and finds your service role key sitting in the bundle.
The failures I find most often are the ones that look like nothing:
- An API key that shipped to the browser because the file had
"use client"at the top - Row Level Security switched off on a table that holds every user's email
- An endpoint that checks whether the button is visible but not whether the request is allowed
- An AI feature with no spend ceiling, where one user with a loop can generate a four-figure bill in an afternoon
- A query that runs in twelve milliseconds at a hundred rows and times out at fifty thousand
None of these break your app. They just make it someone else's.
What I check
A fixed eight-point review, run the same way every time:
- Credentials.
- What's in your client bundle, what's in your git history, what's reachable from a browser.
- Database access.
- RLS policies, table permissions, whether your app is the only thing enforcing who sees what.
- Endpoint authorization.
- Whether every route actually verifies the request, or just assumes the UI did.
- Rate limiting.
- Per user, not per IP. Where it's enforced and whether it survives someone signing up.
- AI and API spend.
- Token budgets, hard ceilings, what one determined user costs you.
- Input handling.
- Validation, sanitization, what happens when someone sends something unexpected.
- Database performance.
- Indexes, query patterns, what breaks at 10x your current data.
- Error handling and logging.
- What leaks in a stack trace, what you'd actually see if something went wrong.
What you get
A written report with every finding rated by severity, in plain language, with the specific file and line.
A walkthrough video where I show you each issue in your own code and explain why it matters.
A prioritized fix list, ordered by what would hurt most, with the actual code to fix it.
48 hour turnaround. You add me as a read-only collaborator. I never need
credentials, and I never need your .env.
One app, one report.
If the audit finds nothing above low severity, I refund it in full and tell you your setup is solid. I'd rather say that than take the money.
Who this is for
Teams with a live product and real users. Solo founders who shipped something that's working and are starting to wonder what's underneath it. Anyone who built fast with AI tooling and never had a second pair of eyes on the backend.
If you're pre-launch with no users yet, wait. Come back when there's something to protect.
Why me
I'm Josh. I build apps and make videos about the ways they break.
Most people who book an audit end up wanting the problems solved, not just listed.
Production Ready is the same audit with everything fixed. Two weeks, fixed price, price depending on scope. We'll talk about it on the call if it makes sense.
Book a call
Thirty Minutes. Tell me what you built and what's worrying you, and I'll tell you whether an audit is worth it.
If the scheduler doesn't load, book directly at calendly.com/josh_mountain.