Aleksandr T.

I'm a senior full-stack engineer and I do independent code, security and architecture audits of web apps, APIs, AI agents and MCP servers, including apps built with AI tools, and help get them production-ready. Clients come to me in one of these situations. The app was built with Lovable, Cursor or Claude Code and you want to know what's unsafe before real users and payments. Or the previous developer left and nobody knows what condition the code is in. Or you build AI agents and need to know what they can do without a human saying yes. Or you are about to scale or sell to bigger clients and need an independent check first. What I check, on the backend and the frontend: - Security, meaning auth and sessions, permission checks on API routes, Supabase RLS and data isolation between users or tenants, injection risks and dependencies with known vulnerabilities - Secrets, where your API keys and tokens end up, in the frontend, logs, files on disk or API responses - Login and OAuth flows, for example redirects that hand tokens to a foreign site, tokens that live too long, cookies without proper flags - Access and revocation, if a removed team member or a deleted device really loses access, and if one user can act as another, for example through a shared account or a header nobody checks - AI agents and MCP servers, what the agent can do without approval, if one approval silently unlocks everything after it, if an email, a PR comment or a web page can steer the agent, if it can read files outside its sandbox or schedule itself to run later. Also cost limits for autonomous runs - Architecture, what will hold with 10x more users and data, what is worth keeping and what needs to be rebuilt - Code quality, error handling, technical debt and tests on the critical parts like payments and access control - Race conditions, double processing and locks that don't really lock - Performance, slow queries and missing indexes, heavy pages, API calls that can be cached or batched - Database migrations and backups, also if you can actually restore from them - AI integrations, prompt injection, cost control and what your app does when the model API is down - Production readiness, how you deploy and roll back, staging vs prod, logs, monitoring and alerts - Docs vs code, if what your README and security docs promise is really enforced in the code, because buyers and investors read them This is a review of code and config, I don't do penetration testing. As for AI-generated code, I see the same problems again and again. Permission checks only on the frontend, RLS policies that look correct but don't restrict anything, service keys in client code, webhooks without signature checks. The stack I work with is TypeScript and JavaScript (React, Next.js, Node.js, Express, NestJS, Electron), Python (FastAPI, Flask, Django), PostgreSQL, MySQL, Supabase, MongoDB, Elasticsearch, Firebase, Docker and Kubernetes, AWS and Google Cloud. The process is simple. You give me read-only access to the repo, NDA is fine. We have a short call about what worries you most. Then you get a report where every issue has a severity, the exact file and line, how to reproduce it and how to fix it. I also mark what I proved from the code and what depends on things outside the repo, so you don't get a list of guesses. Plus a one-page summary in plain English and a step by step plan to get to production with rough estimates. We go through it on a call, and after your fixes I can retest the critical issues. The report is yours, so you can fix everything with your own developers. If needed, I can also continue development after the audit, or rebuild the project if fixing the current code costs more than writing it again. I've been building production software for 8 years, as a developer, a team lead and a CTO. I often took over a product from another team, made it stable and kept building it: web and mobile apps, APIs, search, internal CRMs. So I don't just point at problems, I know how to fix them and how long it really takes. Lately I audit open-source AI agent platforms and dev tools. Several teams confirmed my findings and fixed them within days, for example a stranger getting the owner's access to an AI agent just by using the owner's name, or API keys saved in plain text. One audit of a Next.js and Supabase app built with AI tools found 111 issues in 5 days, 37 of them critical. Send me a link to the app or just describe it and the stack. I'll tell you which audit you need and how long it will take.