Browse categories
Explore
Fiverr Pro
English
$
USD
I will audit your vibe coded app for security vulnerabilities
Muhammad Rayyan
About this gig
Tools like Cursor, Bolt, Lovable, Replit and v0 optimize for "it works" not "it's safe." That gap is where breaches start: exposed API keys, open Supabase/Firebase rules, missing auth, injectable inputs.
I'm a cybersecurity professional. I've shipped production apps and audited codebases to OWASP compliance. I read your code the way an attacker would not just run a linter.
What I catch:
- Exposed API keys & secrets in git history
- Open Supabase/Firebase security rules
- Unprotected Next.js server actions
- Missing auth & rate limiting
- Prompt/AI-agent injection risks
- SQL injection & insecure endpoints
What you get:
- OWASP Top 10 + OWASP LLM Top 10 audit
- Every issue ranked Critical/High/Medium/Low
- Clear fix for each vulnerability
- PDF/Markdown report + Loom walkthrough
- 24-72h delivery
Whether it's a single script or a full-stack prototype, you'll know exactly where you're exposed and how to fix it without losing momentum.
New here? Message me before ordering with one line about your app, and I'll tell you what I'd check and which package fits. No obligation.
Get to know Muhammad Rayyan
Muhammad Rayyan
AI Code Security Auditor, Pentesting, OWASP and Compliance Expert
- FromPakistan
- Member sinceJun 2022
- Avg. response time1 hour
- Last delivery7 months
Languages
English, Urdu, Hindi, German
Cybersecurity pro specializing in security audits & pentesting for AI-generated code (Cursor, Bolt, Lovable, v0, Replit). These tools optimize for "it works," not "it's safe" — that's where breaches start.
I audit against OWASP Top 10 / OWASP LLM Top 10, pentest APIs & auth flows, and check for exposed keys, open Supabase/Firebase rules, missing auth, and injection risks. Compliance-aware: SOC 2, ISO 27001, GDPR, HIPAA, EU CRA.
You get a prioritized report (Critical/High/Medium/Low) with exact fixes. Want it fixed too? I do that.
Ship fast. Ship safe.
My Portfolio
FAQ
Q: What is a "vibe code" security audit?
A: It's a security review specifically for apps built with AI tools like Cursor, Bolt, Lovable, v0, or Replit. These tools optimize for working code, not secure code — I check for the vulnerabilities they commonly miss: exposed keys, open database rules, missing auth, and injectable inputs.
Q: Do I need to share my full source code?
A: Yes — via a private GitHub/GitLab repo invite or a zipped folder. I sign an NDA on request and never store or reuse your code after the audit.
Q: Will you fix the issues, or just report them?
A: Basic includes findings only. Standard and Premium include prioritized fixes — I implement them directly in your codebase.
Q: Do you cover backend/database security too?
A: Yes — Supabase, Firebase, PostgreSQL, MongoDB, and Prisma configs are all checked for exposed rules, weak access control, and injection risks.
Q: What do I receive at the end?
A: A full report (PDF or Markdown) with every issue ranked Critical/High/Medium/Low, a clear fix for each, and a short Loom video walking through the findings.
Q: My app is in production and live already — is that a problem?
A: Not at all, that's actually the most important time to get audited. I can work off a staging clone if you don't want the audit touching production directly.
