Apps built with Lovable, Bolt, Replit, v0 and Cursor ship fast and leave the dangerous parts to you: database rules that let anyone read everyone's data, keys in the browser, logins that only work on the preview URL, payment webhooks that fail quietly. Check yours in 30 seconds, then get it fixed at a fixed price by someone accountable.
Read-only first. I never hold your credentials: you run a read-only query I send you and give me the result.
$500 report in 2 business days
Nothing worth fixing found: you pay nothing.
Book a Launch Check$1,800 done in 5 business days
$400/month, cancel any time
Not sure which fits? Book a free 30-minute call and bring the live URL.
Not a penetration test, not a compliance certification, not a rebuild. If your app needs one of those, the Launch Check says so and its price comes off the quote.
It looks at your app the way a stranger would: the page, the scripts, the public endpoints your builder wired up.
Give read access to the repo and run one read-only query in your database console. I never see your passwords or keys.
Plain English, ordered by risk, with what to change. With Make It Safe, I change it, you watch, and we re-check together.
Adam Gibbons, a DevOps lead with over fifteen years running production systems for banks, insurers and startups: pipelines, cloud, Kubernetes, incident response. Based in Ireland, working UK and EU hours. Hullcheck exists because the same five mistakes keep turning up in AI-built apps, and the only alternatives offered to founders were "run a scanner" or "rebuild it for $15,000".
Yes. It reads public pages and scripts and asks your backend the same questions an anonymous visitor could. It never writes, and it reports what is reachable, not the data itself.
Use it. Lovable's own docs say its scanners do not replace a thorough review, and they check whether a rule exists, not whether it does anything. The paid packages test with a second account, on your real domain, and fix what is found.
For the Launch Check: read access to the repo, the live URL, and the result of a read-only query you run yourself. For Make It Safe: write access to the repo and a temporary collaborator seat in your database project, removed when we finish.
Yes, the checks are the same. The packages are priced for small apps; larger systems get a quote.
Nothing is stored except a count. The server logs a hash of the host and the worst severity found, so I can see how many checks run. See the privacy note.