Your app works.
Is it safe?
We find and fix security holes in apps with specialized cybersecurity agents.
Report and fixes within 48 hours of the agreed start, or 50% back. Full refund any time before the start.
How a hacker can ruin your work
Private data·Secret keys·Payments·Logins·File uploads·AI features·Admin pages·Abuse limits·and more
Right now, anyone could be reading your customers’ data.
After the fixes, only you can.
Common holes, especially in apps built with AI
What a stranger could do today, and what it looks like after the review.
| Area | Before: what a stranger could do | After: what gets fixed |
|---|---|---|
| Private data | Before: Any signed-in user can see other customers’ orders and messages. | After: Each person sees only their own data. |
| Payments | Before: Someone fakes a payment and gets your paid plan for free. | After: Only real, verified payments unlock paid features. |
| Secret keys | Before: Your secret key is inside the app, and any visitor can read it. | After: Keys stay on your server. Any key that leaked gets replaced. |
| Logins | Before: Someone guesses passwords or uses an old reset link to get into an account. | After: Old links stop working, and password guessing is blocked. |
| File uploads | Before: Anyone with the link can open uploaded photos and ID documents. | After: Files stay private, and shared links expire. |
| AI features | Before: One tricky message makes your AI assistant share customer data. | After: Your AI only sees and does what each user is allowed to. |
| Abuse limits | Before: A bot sends thousands of requests overnight and runs up your bills. | After: Limits block bots before they cost you money. |
| Admin pages | Before: Anyone who finds the address can open your admin pages. | After: Only you can open them. |
First questions
Isn’t a scanner enough?
Scanners, including the ones built into app builders, flag common rule and setting problems. They don’t prove what an attacker can actually do on your running app. Lovable’s own security docs say its scans “do not replace a thorough security review”. We read your code, prove what is real on a test copy, and fix it.
Is this a penetration test?
Yes. We attack a copy of your app the way a real attacker would and prove every finding. It isn’t a compliance certificate: if an auditor needs a test from a certified firm, tell us on the call first.
Lovable has its own pentest now. Do I still need this?
Run it, it’s a good tool. But it tests your live app, and it’s Lovable checking apps built on Lovable. We test a copy of your app from the outside, and a human reviewer checks every finding. We also review apps not built on Lovable.
Do you touch my live app?
No, unless you ask us to in writing. Testing a live app can break things or touch real customer data, so we read your code and test a copy of your app. Nothing starts until you sign the short agreement, and you can cancel for a full refund any time before the start.
I don’t have a test copy. Can you still help?
Yes. Many founders don’t have one. On a short call we help you make one: a copy of your app connected to a separate database with test data. It takes about 20–30 minutes and stays useful after the review.
Who does the work?
Specialized cybersecurity agents run the tests in parallel. AI alone can be wrong, so a human reviewer checks every result, reproduces each finding and reviews every fix. You can cancel for a full refund if you’re not comfortable.
Why you can trust the result
- Proof you can re-runEvery finding comes with the exact steps. Run them yourself before and after the fix.
- Test copy onlyWe never touch your live app or your customers’ real data, unless you ask us to in writing.
- Guarantees in writing48 hours or 50% back. Half back if nothing serious turns up. A fixed Critical that breaks again within 30 days is fixed free. Full refund before the start. It’s in the Terms.
- Your code stays privateUsed only for your review, deleted within 30 days, confirmed in writing.
Bardstar is a registered business in Ontario, Canada.
One fixed price per app
No hourly billing, no surprise invoices. If your project is bigger than one app, we quote before you pay.
Normal Review
$799 USD
For one app with logins and customer data.
- Penetration testing on a copy of your app
- All 8 areas checked
- Basic payment and AI checks
- Proof for every finding, with steps you can run again
- Ready-to-merge fixes and a plain-English report
- 30-minute walkthrough call
- Free retest within 15 days
- Not included: Deep payment and AI agent testing
- Not included: 1-page security summary for investors
Review Plus Payments and AI agents
$1,499 USD
For apps that take payments or have AI that acts on user data.
- Everything in Normal Review
- Deep payment testing: refunds, subscriptions, webhooks
- Deep AI agent testing: prompt injection, tool permissions, data leaks
- 1-page security summary for investors and customers
- Two free retests within 30 days
Both plans: report and fixes within 48 hours of the start, or 50% back. No Critical or High finding? Half your fee back. Full refund any time before the start.
More questions
You’re new. Why should I trust you?
Fair question. We’re new, with no client logos or testimonials yet. Before you pay, check the sample report and our notes, or ask us anything on the free 20-minute call. No review finds everything.
What does “a human signs off every finding” mean?
No finding reaches your report until a human reviewer has reproduced it on your test copy and written down the exact steps. Anything we can’t prove is left out. You can re-run every proof yourself.
What happens to my code and data?
Used only for your review and kept confidential. We test with test data only and delete your code, access and test data within 30 days of delivery. Your agreement names the AI providers that process your code; if you don’t accept them, you get a full refund. Happy to sign your NDA.
What if you find nothing serious?
You get the report, proof your app held up, and half your fee back. Serious means a Critical or High finding, as defined in our Terms.
My app is big. Is it still one price?
One review covers one app: one frontend and its backend. Bigger? We quote a fixed price before you pay, or refund you in full if you already paid.
What if you miss the 48 hours?
We still deliver, and you get 50% of your fee back. The clock starts once the agreement is signed and your test copy works, and pauses only while we wait on you.
I’m not technical. How do I apply the fixes?
Each fix comes as a pull request, plus steps you can paste into your app builder. On the walkthrough call we apply them with you.
Can I see a sample report?
Yes. Here is a full sample report on a demo app with common mistakes left in on purpose.
Find out before someone else does.
Book a free 20-minute call, or buy a review now and pick a start time that suits you. Full refund any time before the start.