Aleksandr T.

I'm a senior full-stack engineer and I do independent code, security and architecture audits of web apps, APIs, AI agents and MCP servers, including apps built with AI tools, and help get them production-ready.

Clients come to me in one of these situations. The app was built with Lovable, Cursor or Claude Code and you want to know what's unsafe before real users and payments. Or the previous developer left and nobody knows what condition the code is in. Or you build AI agents and need to know what they can do without a human saying yes. Or you are about to scale or sell to bigger clients and need an independent check first.

What I check, on the backend and the frontend:

• Security, meaning auth and sessions, permission checks on API routes, Supabase RLS and data isolation between users or tenants, injection risks and dependencies with known vulnerabilities
• Secrets, where your API keys and tokens end up, in the frontend, logs, files on disk or API responses
• Login and OAuth flows, for example redirects that hand tokens to a foreign site, tokens that live too long, cookies without proper flags
• Access and revocation, if a removed team member or a deleted device really loses access, and if one user can act as another, for example through a shared account or a header nobody checks
• AI agents and MCP servers, what the agent can do without approval, if one approval silently unlocks everything after it, if an email, a PR comment or a web page can steer the agent, if it can read files outside its sandbox or schedule itself to run later. Also cost limits for autonomous runs
• Architecture, what will hold with 10x more users and data, what is worth keeping and what needs to be rebuilt
• Code quality, error handling, technical debt and tests on the critical parts like payments and access control
• Race conditions, double processing and locks that don't really lock
• Performance, slow queries and missing indexes, heavy pages, API calls that can be cached or batched
• Database migrations and backups, also if you can actually restore from them
• AI integrations, prompt injection, cost control and what your app does when the model API is down
• Production readiness, how you deploy and roll back, staging vs prod, logs, monitoring and alerts
• Docs vs code, if what your README and security docs promise is really enforced in the code, because buyers and investors read them

This is a review of code and config, I don't do penetration testing.