A desktop app that audits AI-built SaaS before launch — by attacking it the way an attacker would, from your own machine, with your own keys.
Lovable, Bolt, Replit, and Cursor will get a founder to a working app shockingly fast, and their built-in scans catch some of the basics. But a checkbox that says "RLS enabled" won't tell you your database is still readable by anyone with your public key, that your Stripe secret is sitting in the browser bundle, or that your .env file got committed to a public repo. Those aren't exotic hacks — they're the same handful of misconfigurations, over and over, and they're exactly how vibe-coded apps get breached.
I kept seeing the same holes in AI-built apps — including my own early ones. So I built the checklist I wished existed: one click, and it tells you whether you're about to launch with the door open.
Every product page here includes this section, because "four shipped products" means four sets of problems that didn't solve themselves.
The database and keychain libraries are native modules compiled against Node's ABI — and Electron ships its own. The result was a wall of ERR_DLOPEN_FAILED errors every time the environment shifted. The fix was a proper rebuild pipeline that recompiles the native modules for Electron's ABI, plus unpacking them from the app archive at package time. Tedious, invisible to users, and completely mandatory.
Trial enforcement is local, which means someone determined enough can reset it with a clock change or a reinstall. I could have built a phone-home system to stop that. I didn't, and the tradeoff is documented in the code: the paid unlock validates server-side and can't be forged, and that's the part that matters. Knowing which battles not to fight is an engineering decision too.
The hardest part wasn't a bug — it was wording. A tool like this could easily print "Your app is secure ✓" and make users feel great. It would also be a lie. The report language took real deliberation: findings are ranked by severity, and a clean pass says exactly what was checked and nothing more. That same standard carries into my client audit reports.
Ms. Vibecode is one of the things I've built for myself. If you've got an app, an iOS build, or an internal tool you need taken from idea to shipped, that's the day job.
Tell me what you need built