TamperingSecondhand marketplace
A £2,000 item, yours for 1p
Prices were worked out in the browser and saved straight to the database. A buyer could rewrite the total before checkout.
You built something real. Do you know it's secure?
Built with Lovable, Bolt, Replit, v0, Cursor or Claude? We scan your repository and your live site, explain what we find in plain English, and give you a prompt to paste in and fix everything.
Scan my code for freeFind out how many issues you have before you pay anything."Holy s***, that's a lot of things."
Robert BoweyCo-Founder & Technical Director, Marka
100% of the codebases we've scanned had
critical security issues
78%
had API keys or secrets exposed in their code or its history
67%
let a stranger change or trigger things without logging in
44%
let someone get a product or paid features without paying
Figures from Startup Launchpad scans, 2026.
Find out how many issues you have before you pay a penny.
Connect your repository and we scan it for free. You get your real numbers across all five areas, split by severity, so you know exactly what you're dealing with.
Scan my code for freeFounder story
Rousseau got 1.5 days of security review in a few minutes
One scan of Nucha, his live platform. It matched what his own pen tester had already found, and he started the clean-up the next morning.
Get started for freeIt did in a few minutes what my security colleague spent 1.5 days to unearth.
Rousseau Jean-JulienFounder, NuchaEverything you need
demo/your-appExample scan
Security
161open issues
- 13 critical
- 53 high
- 28 medium
- 10 low
- 57 info
Accessibility
26open issues
- 11 high
- 14 low
- 1 info
SEO
40open issues
- 3 high
- 30 low
- 7 info
Reliability & Performance
16open issues
- 14 medium
- 2 info
Housekeeping
583open issues
- 532 low
- 51 info
"That's incredible what you've built, guys, honestly... even just the visual side of it, it's brilliant, it's so intuitive."
Jo WinsladeFounder, BarzVibeReal findings we caught in live applications
SpoofingSubscription platform
Paid features without paying
The payment webhook never checked who was calling. A fake "payment completed" message marked any account as a paying subscriber.
Elevation of privilegeMarketplace
Make yourself an admin
Any logged-in user could add one extra field to a routine profile update and give themselves full admin rights.
Your issues explained in plain English.
Then fixed with Ctrl+V
"I like how simply it's explained. You're clearly explaining the scenario rather than giving me just a bunch of words I don't understand."
Alice ClementsFounder, Tooti MusicYour profiles table can be read by anyone
Row-level security isn't switched on for this table. Anyone who opens your site can copy the public Supabase key out of your JavaScript and read every row in it: names, email addresses, and anything else you store there.
supabase/migrations/0002_profiles.sql:14No alter table ... enable row level security statement on this table.Fix prompt
In supabase/migrations/, add a migration that enables Row Level Security on the `profiles` table, with policies so a signed-in user can select and update only their own row (auth.uid() = user_id). Do not add a policy granting the anon role read access to all rows. Then check every other table in the schema for the same gap and list any you find. Review the change before merging.
Peace of mind, even for the pros.
Even as a seasoned software developer, I feel calmed knowing all my code changes are being checked daily by a 'security expert' system. It's well worth paying to remove the stress of unknown security issues and broken code, and having more time to work on the fun parts of running a tech business!
See what's in your code. Your first scan is free.
Scan my code for freeWhat founders said once they'd seen their own results.
"You're giving me my time back. Otherwise I'm spending however many hours researching things that don't actually move me forward."
Alice ClementsFounder, Tooti Music"You're not selling them their problems. You're selling them the ways to solve and fix all those problems."
Robert BoweyCo-Founder & Technical Director, Marka"All you know is you have a very fancy interface, very nice looking, but the truth is at the back end there's so much gateway for a hacker."
"Looks great from a user's point of view. Nice and easy to use."
"That's good, that we have that exercise, because that means the AI is not making things up either."
Rousseau Jean-JulienFounder, Nucha"There's a whole bunch of people vibe coding stuff now that don't really know what they can do, and they can totally make mistakes."
Robert McLeodFounder, HutScanner"The good thing is I can fix it, so I don't have to pay someone to fix it all."
Jo WinsladeFounder, BarzVibeHow it works
- ConnectInstall our GitHub app. Read-only, and you can revoke it whenever you like.
- Scan freeThe scan runs against your repository and your live site. You find out how many issues you have, by area and severity.
- UnlockFor £20 a month, each finding says what's wrong, how someone would abuse it, and gives you a prompt to paste in to fix it.
- Keep watchingSubscribers get their repository checked every 6 hours and a full sweep every week.
Step one takes a couple of minutes.
Connect my GitHubPricing
See your numbers first. Pay when you want the fixes.
Your first scan
Free
- Full scan of your repository and live site
- Your issue count across all five areas
- Broken down by severity, so you know how many are critical
Ongoing protection
£20 a month
- Every finding explained in plain English
- A fix prompt to paste in for each one
- Repository checked every 6 hours
- Full sweep every week
- Cancel any time
Under 1% of a contractor one day a week.
See full pricing and how it compares →
"I was paying 250 quid a month for a similar service. So the price has come down and the value has gone up."
Rosie McGilvrayThe NetworkerQuestions you should be asking
How does the scan work?
Around 90% is fixed rules run by purpose-built engines, so you get the same result every time. The other 10% is AI, guided by STRIDE threat modelling, looking for the ways someone would chain weaknesses together.
Does this replace a pen test?
No. It's a cheap, constant first pass that catches most of what a manual review would spend its first day or two on. If you're handling sensitive data at scale, you'll still want a human to sign it off.
Do I need to get every number down to zero?
No. No piece of software sits at zero. Start with the criticals, then the highs. Housekeeping is usually the biggest number and the least urgent.
I'm not technical. Will I understand it?
That's who it's built for. Findings are written in terms of what could happen to your business, and each one has a prompt you can paste into the AI tool you already build with.
What access do you need?
A GitHub app with read-only access to contents and metadata, using short-lived tokens for each scan.
What happens to my code?
It's never kept at rest, never written to logs and never sent to a third-party model. Everything runs in the UK.
Find out what's in your codebase before someone else does.
Connect your repository, run the scan and see your numbers. No payment until you decide to unlock the fixes.
Scan my code for freeInfo@SurgoTechSolutions.co.uk · +44 7407 742219
What you've given me will be a huge help, I can't thank you enough!
Jo WinsladeFounder, BarzVibe