Software audit
You built it with AI. Is it safe to ship?
I audit software written by people and by agents. Mostly agents now, because that's where everything is going. Send me your code and I'll give you an honest opinion on whether it's safe to ship, with basic recommendations. It's free.
Send me your code
One prompt. Your agent does the packing.
Copy this prompt into the AI tool you built with: Claude Code, Cursor, Codex, Replit or similar. It zips up your project, strips out passwords, keys and any customer data, and gets it ready to email to me. Read it first if you like. Nothing in it sends anything without you seeing it.
Read the prompt
I'd like a free code audit from amillionmonkeys. Please package this project so I can email it to them. Work through these steps and show me what you did before anything is sent. 1. Make a zip of the project's source code and configuration. Leave out dependency and build folders (for example node_modules, vendor, .next, dist, build), version-control internals (.git), caches, logs and anything over 10 MB. 2. Do not include any personal data. Leave out database dumps, exports, CSVs, spreadsheets, seed or fixture files containing real records, uploaded files, images of people, and logs. If a file mixes code with real customer details (names, emails, phone numbers, addresses, payment or health information), replace those details with obvious placeholders. 3. Do not include any secrets. Leave out .env files and anything like them. Search every remaining file for API keys, passwords, tokens, private keys and connection strings, and replace each value with REDACTED. Include a .env.example listing the variable names only, with no values. 4. Include the database structure without any data: the schema or migrations, plus any access rules (for example Supabase row-level security policies). If you can't export these, list the tables and their columns instead. 5. Add a file called AUDIT-NOTES.md covering: what the app does in two sentences; which tools built it; where it's hosted; how people log in; whether it takes payments, and through which provider; roughly how many users it has; and anything I'm worried about. 6. Before finishing, list everything you excluded or redacted, and confirm the zip contains no personal data or secrets. Tell me its size. If it's over 20 MB, suggest what else to leave out. 7. Finally, draft an email to hello@amillionmonkeys.co.uk with the subject "Free audit: [app name]", the zip attached and AUDIT-NOTES.md pasted into the body. If you can't send email, tell me where the zip is saved so I can attach it myself. Don't send anything until I've checked it.
- Built with Lovable, Bolt or v0? Connect the project to GitHub and invite philyboysmith as a read-only collaborator instead.
I only use your code for the audit, delete it when we're done, and I'm happy to sign an NDA first.
Two questions, one audit
Is it safe for real users and real data?
Not just a demo. Can one customer see another's records? Are your keys sitting in the code? Would a refund or a failed payment do something odd?
Can you keep shipping?
Vibe-coded apps often get slower to change with every feature. I look at how changes get from idea to live, and what will hurt in month three.
The gap
It works. That isn't the same as safe.
You're a founder, a designer, a marketer or a product person, and you built something real with AI tools. It works, it looks right, and people are starting to use it.
AI tools write code that runs. They're much less reliable at the parts that break quietly: who can see whose data, what happens when a login goes wrong, where the secrets live. In 2025 a single flaw in Lovable-built apps left more than 170 live apps' databases open to anyone. A scan of 5,600 vibe-coded apps found over 400 exposed secrets.
You've probably asked the AI to check its own work. The trouble is it doesn't know what it doesn't know, and neither do you. That instinct to get someone experienced to look is the right one.
Where AI-built apps break
The usual suspects.
- Customers seeing each other's dataCritical
- Logins that can be bypassedCritical
- API keys and secrets in the codeCritical
- Payments and webhooks that misfireCritical
- Testing on the live databaseHigh
- No backups, or untested onesHigh
- Every change getting riskierHigh
- Finding out from an angry customerMedium
What I check
Everything that matters before you invite real users.
Logins and accounts
How people sign in, how sessions work, and whether anyone can get in by fiddling with a URL or a token.
Who can see what
If you have more than one customer, can one see another's data? Database access rules, API permissions and file storage.
Payments
Stripe, webhooks, refunds and subscriptions. If money moves through it, it gets a closer look.
Secrets and environments
Keys in the code, live and test kept apart, and whether a leaked key from an old project still works.
Personal data and UK GDPR
What you store, where, and whether you'd know if it leaked. The basics you'd want in place before the ICO asks.
Hosting, backups and monitoring
Whether you can restore last Tuesday, and whether you hear about problems before your customers do.
How you ship changes
Deploys, rollbacks, tests and the bits that make every new feature slower if they're missing.
Code you can live with
Whether the next person, or the next AI session, can understand it without breaking something else.
What you get
A report you can act on, whoever does the fixing.
The free audit gives you an honest go or no-go, a red, amber or green rating for each area, and basic recommendations: what's wrong, why it matters and what to do first. If you want the fixes done, I'll quote a fixed price.
01
Is it safe to ship?
A straight answer. If it's fine, I'll say so. If it isn't, I'll say why.
02
What to fix first
Anything that could leak data, lose money or let someone in, in priority order, with basic recommendations you can act on yourself.
03
A fixed price for the fixes
If you'd like me to do them. No obligation, and no chasing if you'd rather do it yourself.
Pricing
The audit is free. The fixes are fixed price.
The audit and its basic recommendations cost nothing. If you'd like me to fix what I find, you get a fixed quote first, and it doesn't change halfway through.
Audit
An honest opinion on whether it's safe to ship, ratings for each area and basic recommendations. Usually within five working days.
Free
Fix
I fix what the audit found, in the tools you already use. Critical security first. A step-by-step fix list you can hand to your AI tool is included.
£2,500–£7,500
Rebuild
Only if fixing would cost more than starting properly. That's what happened with Treatdeck.
From £5,000
Keep watch
A senior pair of eyes on the code every month while you carry on building with AI.
From £1,000/month
Why free? Most AI-built apps need some fixing, and an honest audit is the best way to show you whether I'm the right person to do it. If your code is fine, you'll hear that too.
Asking the AI vs. asking me
Why a human still needs to look.
| Asking your AI tool to check | An audit | |
|---|---|---|
| Security | Checks what it thinks to check | Logins, data access, secrets and payments, deliberately |
| How you ship | Can't see how you work | Deploys, tests, rollbacks and monitoring |
| Answer | "Looks fine to me" | A written go/no-go with ratings |
| Experience | Generic best practice | Nearly 20 years of production software |
| Accountability | None | A named person who stands behind it |
I use AI tools every day, including to help with audits. They make me faster. They don't replace knowing where software breaks.
Been there
From vibe-coded prototype to production.
Treatdeck's founder built a working prototype in Base44 before calling me. Instead of throwing it away, it became the spec for a proper rebuild with real logins, secure data and subscription billing, for less than a third of the cost of starting from scratch.
Treatdeck
A vibe-coded Base44 prototype, rebuilt properly for production for less than a third of the cost of a ground-up build.
Read the case study →Fit
Who this is for
- Founders who built a working app with Lovable, Bolt, Replit, Cursor, Claude Code or similar, and want a proper look before inviting real users.
- Anyone holding customer data, financial records or payments in something they can't read themselves.
- Teams who've already launched and feel every change getting slower and scarier.
- Businesses with an internal tool that "someone built", which 40 people now rely on and nobody understands.
- Agencies shipping AI-generated code to clients who want an independent check before handover.
- Software written the old-fashioned way, by people. It gets exactly the same audit.
Questions
Fair questions.
Is it really free?
Yes. The audit, the safe-to-ship verdict and the basic recommendations cost nothing, with no obligation. I charge for fixing things, and only if you ask me to.
Will I have to start again?
Usually not. Most apps can be fixed where they are. If fixing would genuinely cost more than rebuilding, I'll say so and show you why. That's a judgement for the report, not a sales pitch.
What access do you need?
The quickest way is the prompt on this page: your AI tool zips the code without secrets or customer data. Or invite philyboysmith to your GitHub repo as a read-only collaborator. I'm happy to sign an NDA first, and I delete your code when we're done.
Which tools and stacks?
Lovable, Bolt, Replit, v0, Base44, Cursor, Claude Code and Codex, usually sitting on Supabase, Firebase, Vercel or similar. If it's a web or mobile app, I can read it.
Can I keep vibe coding afterwards?
Yes. That's the point. The report is written so your AI tool can act on it, and Keep watch exists for people who want to carry on building with someone senior checking in.
I'm not technical. Will I understand the report?
Yes. Red means fix it now, amber means plan it in, green means you're fine. Every finding says why it matters in plain English.
Is this a penetration test?
No. A pen test attacks a system from outside. The audit reads the code and the setup to find the problems before anyone attacks it. If you need a formal pen test for a client or an investor, I'll tell you and point you to someone good.
Next step
Find out if it's safe to ship.
Copy the prompt above and send me your code, or book a 20-minute call if you'd rather talk first. Either way, the audit is free.