Ready to Go Live?
- Your code
- Report
Sample report
Meridian Coaching is a fictional sample app on meridian-coaching.example. The findings come from its deliberately flawed example code.
Not ready for real users yet.
Fix the 6 blockers below before real users sign up.Do not open this to customers yet: signed-in users can delete other people's bookings, and coach prices can be changed from outside the app. Customers can also pay for the same session time or pay after their booking has been deleted. These problems can be fixed with targeted changes; you do not need to start again.
28
45
90
45
Fix these first
One at a time. Then retest.A secret key is written directly in the codeSecurity · Secret keys · supabase/functions/create-checkout/index.ts:4
Some access rules let everyone throughSecurity · Users' data · supabase/migrations/20260801090000_init.sql:27
Anyone on the internet can run up your AI or messaging billSecurity · AI and email bills · supabase/functions/generate-plan/index.ts:1
Any signed-in customer can delete another customer's bookingSecurity · Users' data · supabase/migrations/20260801090000_init.sql:67
Two customers can pay for the same coach at the same timeStability · Payments · supabase/functions/create-checkout/index.ts:26
A customer can be charged after their booking has been deletedStability · Payments · src/pages/Bookings.tsx:8
Your answers by area
Security4 blockers
Scalability3 things to fix
OwnershipLooks fine
Stability2 blockers
Blocks launchNeeds fixingLooks fineNot checked
AI tool detected
We found Lovable in your code.
Want a person to check it?
The Free Build Audit: we go through your app by hand and record a walkthrough of what stays, what to fix, and what blocks launch.Get a Free Build AuditFree. Limited each week.