Built fast? Now make it safe.

You moved fast with Lovable, Bolt, v0, Replit or Cursor, and now real customers use it. We find the leaks before someone else does, fix them at a fixed price, and help you scale without a rewrite you didn't need.

Take the 2-minute self-checkBook an audit

The hole is underneath

It works on screen. AI tools are excellent at what you can see and inconsistent at what you can't: who may read which row, where keys live, what happens when 500 people log in at once.

byfocus audit · sample-bookings-appCompleted13 lines

09:14:02Debug: DBGaudit$ byfocus audit ./sample-bookings-app
09:14:03Info: INFOaudit214 files · 3 database tables · 41 dependencies
09:14:05Info: INFOaccessRead-only access confirmed. NDA on file.
09:14:07Error: ERRdbCRITICAL Table 'bookings' readable without login (no row-level policy)
09:14:08Error: ERRbundleCRITICAL Service key found in browser bundle: assets/index-8f2c.js
09:14:10Warning: WARNauthHIGH /admin has no role check, any signed-in user can open it
09:14:12Warning: WARNauthHIGH No rate limit on /login (password-guessing risk)
09:14:13Warning: WARNopsMEDIUM No automated backups configured
09:14:15Warning: WARNdepsMEDIUM 3 dependencies with published vulnerabilities
09:14:17Info: INFOtestsLOW No tests cover the payment flow
09:14:19Info: INFOloadLoad test: 500 sign-ins in 60 s, p95 2.8 s, 4% errors
09:14:20Success: OKauditSummary: 2 critical · 2 high · 2 medium · 1 low
09:14:22Success: OKauditNext: plain-English report and fixed-price fix plan in 5 business days

Sample output from a demo app we built insecure on purpose. Not a real customer.

What we usually find

01
Database tables open to logged-out visitors
02
Secret keys shipped inside the browser bundle
03
Admin pages without a role check
04
No backups, or backups nobody has restored
05
Every fix breaks something else, because nothing is tested

// Runs in the browser, shipped to every visitor
const db = createClient(URL, SERVICE_ROLE_KEY)
const { data } = await db.from('bookings').select('*')

// No row-level policy on 'bookings'.
// Anyone who opens dev tools can read every booking
// and reuse the key to change them.

Illustration of the most common pattern behind incidents like CVE-2025-48757.

2.8 s 0.4 s

Slowest 5% of requests in the sample app, before and after the fix, under the same 500-user load test.

Fixed, then measured again

Every fix ships through tests and review, then we run the same load test as the audit. You see the before and after on one chart, and the numbers go into the signed report.

p95 response time, after the fix

0.42s

85% faster

fix deployed

31 days agoToday

The same load test, after the fix

Sample audit app, 500 sign-ins a minute. Missing indexes, a cache and a rate limit took p95 from 2.8 s (red) to 0.4 s (navy).

How exposed is your app?

Eight questions. Your answers stay in your browser.

out of 100

Medium risk

There are gaps an attacker would look for first. An audit tells you which ones matter and what they cost to close.

0/8 answered. “Not sure” counts as half risk. This is a self-check, not an audit.

Book a Security & Scale Audit

Was it built mostly with an AI app builder or AI coding tool?
Does it store customer names, emails, bookings or payments?
Can a logged-out visitor be blocked from every database table?
Are all secret keys kept on the server, never in the browser?
Do you have daily backups and have you tested a restore?
Has an engineer reviewed the code line by line?
Are there automated tests for login and payments?
Is the login page rate-limited against password guessing?

Audit, harden, or rebuild properly

01
US$490–990
Security & Scale Audit
Start here. Data access rules, keys, auth and admin routes; dependencies, backups and rate limits; a load test against your expected traffic; and a plain-English report with a fixed-price fix plan.
02
from US$1,500
Hardening
The most common next step. We fix every critical and high finding, add tests around login, data and payments, set up backups we have restored, then re-scan and sign the report.
03
from US$4,900
Rebuild on Byfocus
When it has outgrown its first build. The same features on a proper Laravel architecture, your data migrated and users kept, the audit fee credited in full, and the code and hosting in your name.

Prices in USD, fixed before we start. Proposals can be fixed in CAD or NZD.

Careful with your system from the first minute

01
Day 0
NDA and written permission
We sign an NDA and you authorise the audit in writing. We never test anything you don't own.
02
Day 1
Read-only access
Temporary read-only access to your code and a copy of your database. No passwords by email.
03
Days 2–4
Review and load test
A senior engineer works through access rules, keys, auth, dependencies and traffic.
04
Day 5
Report and fix plan
Severity-ranked findings in plain English, with a fixed price for each fix. Access revoked.

The same team builds and looks after these

InterGreat's campaign page takes 4,000 leads every two months and hands each one to the CRM in about a second. Truong Phuc's booking forms feed telesales the same way. The engineers who audit your app are the ones who run them.