AI-built app check
You built it with Lovable, Replit, Cursor or Claude Code and it works on the screen. I check the parts you can’t see, the code, the data and the security, and tell you in plain words what to fix first.
Tell me what you builtFixed price for one app, or the part that matters most
The price is agreed in writing before any work starts. Send what you built and I reply with a quote. An enquiry does not charge you or approve a release.
Sound familiar?
Bring the app and what "ship" means to you. I read the code, run it where access allows, and check where your customers’ data goes, who can reach it, and whether the app will hold up as more people use it. We agree the boundary before I start.
Who it suits
An app you can describe, and someone authorised to grant read access once the scope is agreed. Built with Cursor, Claude Code, Copilot, Lovable, Replit, Bolt or v0 is fine.
No surprise booking
Your email and a few sentences are enough to start. No files or account access needed.
I’ll reply by email about the task, scope and price. If it isn’t a fit, I’ll say so.
We arrange the work only after agreeing what is included. Sending this form does not book or charge you.
Fixed price for one app, or the part that matters most. The price is agreed in writing before any work starts. Send what you built and I reply with a quote. An enquiry does not charge you or approve a release.
Variant
The same check, scoped against a named checklist: OWASP Application Security Verification Standard Level 1 and the OWASP Web Security Testing Guide. You get the checklist items I covered, what I found, and the items I did not cover. It is not a penetration test, a security certification or compliance sign-off, and the report says so.
Quoted with the app check. Ask for it in your enquiry.
The same rules on every job
Who you’ll work with
I’m a software developer based in Newcastle, Australia. You’ll work with me directly. Newcastle, the Central Coast and Sydney, and remote everywhere.
Start with your task. I’ll check whether it fits my experience and explain the scope before you decide to go ahead.
Check whether my task fitsWork you can inspect
Open-source review and quality tooling I built and maintain. Public repositories you can read before you decide whether my check would be worth having.
Quality gates that run on every change before it merges.
Evidence capture for checks: screenshots, console logs and network requests at every step.
These are my own open-source projects, not client work, and I am not claiming they have a user base. They are MIT licensed and documented so you can read the code and judge the standard of it before you trust me with yours. There are 57 more in the open.
Finding example · my own website
A finding from my own enquiry form shows the difference between a screen that says "sent" and data that was actually saved.
The form reported success as soon as the request left the browser, before the server confirmed the record was written.
A dropped connection could show a visitor "sent" while nothing reached the inbox, and the enquiry would be lost without anyone knowing.
Submit with the server unreachable. The form must report the failure, keep the text, and only show "sent" once the server returns a receipt.
This finding comes from my own site and its fix is in the site’s code. It demonstrates the report format, not a paid client outcome or a complete security assessment.
This finding covers one form’s save path. It says nothing about authentication, payments or the rest of the application. A useful report names those limits instead of turning one passing check into an all-clear.
The practical details
A small app in full, or the part of a larger one that matters most, such as sign-up and payment. If it will not fit the quote, I say so before starting and we narrow the scope or agree a second part.
Both, where access and environment allow; we agree that before I start. The report says which findings I reproduced by running and which came from reading.
Not inside the check. The deliverable is findings in fix-first order with a suggested fix for each. Repairs are separate: small ones by the hour under guided build, larger ones quoted.
No. I check the security basics and flag what I see, and the security-readiness variant reviews against OWASP ASVS Level 1 and the OWASP Web Security Testing Guide. Neither is a penetration test, a certification or compliance sign-off.
A fixed price for one app or the part that matters most, agreed in writing before any work starts. Send what you built and I reply with a quote. A second part, or a re-check after you apply fixes, is quoted before starting. Nothing is charged for sending an enquiry.
No. It is a bounded assessment and it cannot promise that every defect was found. You keep the release decision, with the checked areas and the unchecked ones written down.
Read-only repository access or a zip, how to run it, what "ship" means to you, and anything already checked. No credentials in the message; we agree the minimum access separately.
You don’t need a polished brief.
Start an enquiryAI-built app check
I’ll read your enquiry and reply by email about fit and next steps. No booking or charge.
Prefer email? hello@calvinkennedy.com · Prefer an ordinary contact page? Use the contact form.
