A Recent Review: What I Actually Found

The app

A solo founder built a booking and client-management tool over a few weeks with an AI app builder — the kind of product where customers log in, manage their own profile, and schedule time with someone on the other side. It looked finished. It was finished, in the sense that mattered to the founder: you could sign up, book a slot, and get a confirmation email. They booked a call with me the week before they planned to open it up publicly.

What was solid

Worth saying up front, because I'd rather report this straight than talk up the scary parts: the core product worked. The UI was clean, the booking flow made sense, and the database schema was sensibly modeled — better than a lot of hand-rolled MVPs I've seen from experienced teams, honestly. The AI tool had clearly done a lot of the tedious, easy-to-get-wrong plumbing correctly. None of what follows changes that.

What needed attention

Here's roughly what a review like this turns up, in the order I usually find it:

• Any logged-in user could view any other user's bookings by changing an ID in the page URL. The page checked that you were logged in, not whose data you were asking for.
• The admin dashboard had no server-side auth check at all. It was hidden from the nav for non-admins, which stops a person from clicking a link. It does not stop a person from typing one.
• A third-party API key was sitting in the client-side bundle, visible to anyone who opened dev tools, on a plan with no spend cap.
• The login form had no rate limiting, so nothing stood between it and a script trying ten thousand passwords overnight.
• The file storage bucket allowed public listing, meaning uploaded documents were guessable, not just accessible-if-you-had-the-link.
• There was no alerting of any kind. If any of the above had already been found by someone else, the founder would have had no way to know until a customer told them.

None of these are exotic. They're the same six or seven issues, in some combination, on almost every app I review. That's not a coincidence — it's exactly what happens when a tool optimized for "does this feature work" meets a question it was never asked: "what happens if someone tries to misuse it."

What happened next

I wrote it up the way I write every report: plain English, ranked by what actually mattered first — the account-data exposure and the open admin route went to the top, the rest followed. The founder took the report straight to their AI tool, pasted in each finding, and had working fixes for most of it within a day. We got on a walkthrough call for the two items worth talking through rather than just patching. The app launched on schedule.

If any of this sounds familiar — an app that works, that you're proud of, that you haven't had a second set of eyes on yet — that's exactly the point where a free call is worth 30 minutes of your time.