Check-up Express
For MVPs and prototypes (the first versions of an app)
€310
- Report in 5 working days
- The 3 most critical areas
- The 10 most urgent problems
- Video call to explain the results
You built your app with AI. Find out if it really holds up.
I read code written with Lovable, Cursor, Bolt or v0 and tell you what is broken, what is dangerous and what it costs to fix.
Fixed price · from €310
Price
Fixed · from €310
Confidentiality
Signed agreement
Video call
Included
Overall verdict
Ready with reservations
Score
5.3 / 10
- Security 3/10 critical
- Data and database 6/10 needs work
- Reliability 5/10 needs work
- Architecture 7/10 needs work
- Quality and maintainability 6/10 needs work
- Performance and growth 8/10 good
- Release and infrastructure 4/10 critical
- Tests and process 3/10 critical
About 6 days of work to go to production
Sound familiar?
AI writes code that works in the ideal case. It often skips security and error handling, which real users need.
You need a check-up if at least one of these sentences describes your app:
How it works
There is no sales call. We start from a form, and the video call comes after the report.
-
1
You fill in the form. You tell me what you built, with which tool and what worries you.
-
2
I reply within 1 working day. I confirm whether I can help and which package you need.
-
3
We sign a confidentiality agreement together. Then you pay and give me read-only access to the code.
-
4
You receive the report within the time of the package you chose.
-
5
We talk it through on a video call. Then you decide what to do.
Prices
The price is fixed and you know it before we start.
Recommended for apps with users or payments
Full Audit
For apps already live or with payments and user data
€790
- Report in 10 working days
- All 8 areas
- Phased action plan
- Quote for the fixes
- Video call to explain the results
If you hire me for the fixes within 30 days, I deduct the cost of the audit from the price.
What I check
I score eight areas from 1 to 10. The Express covers the three most critical: security, reliability and architecture.
| No. | Area | What I look at | Express |
|---|---|---|---|
| 1 | Security | Exposed keys, login and permissions: who can read your users' data. | ✓ |
| 2 | Data and database | Structure, backups and migrations: the risk of losing data. | — |
| 3 | Reliability | Errors handled or hidden, payments and edge cases. | ✓ |
| 4 | Architecture | How the code is organised and where everything breaks at once. | ✓ |
| 5 | Quality and maintainability | Duplicated or unused code: how easy it is to change. | — |
| 6 | Performance and growth | Slow pages and what breaks when more users arrive. | — |
| 7 | Release and infrastructure | How the app is published, environments, monitoring and cloud costs. | — |
| 8 | Tests and process | Tests, automated checks and version management. | — |
What you get
You get a PDF report written for decision-makers as well as developers. In it you find:
- 1 A clear verdict: your app is ready, ready with reservations or not ready.
- 2 The problems in order of urgency, explained for non-developers too.
- 3 Time and cost: for each problem, how long it takes and what it costs to fix.
Overall verdict
Ready with reservations
Score
5.3 / 10
- Security 3/10 critical
- Data and database 6/10 needs work
- Reliability 5/10 needs work
- Architecture 7/10 needs work
Issue log
-
Database key published in the repository
Anyone who can see the repository can read and delete all the data.
-
Every change goes straight to production
A bug reaches users immediately, with no staging environment.
-
The orders list downloads every record each time it opens
With more customers the page slows down and costs go up.
What I found in apps built with AI
Here are some real cases from my clients. Open a case to read what I found and how I fixed it.
The OpenAI key was in the browser
Security Fixed- Project
- App with an AI assistant, built with Lovable.
- What I found
- The OpenAI key was in the code that runs in the browser. Anyone could copy it and use it at the client's expense.
- How I fixed it
- I revoked the key and created a new one. I moved the calls to the server, with usage limits.
A table without RLS policies
Security Fixed- Project
- E-commerce built with Lovable and Supabase.
- What I found
- Only the orders table was open: the app's public key exposed every customer's name, address and purchases.
- How I fixed it
- I put RLS policies on every table: they decide who reads each row. A check now flags tables without protection.
The Pro plan could be unlocked from the browser
Security Fixed- Project
- Subscription SaaS, written with Claude and Cursor.
- What I found
- The app checked payment only in the browser and ignored the webhook signature. Changing one variable made the Pro plan free.
- How I fixed it
- The server now verifies the subscription and checks the webhook signature.
The admin panel was open to every user
Security Fixed- Project
- Internal management app, built with Lovable.
- What I found
- The admin page was left out of the menu. With its address, anyone who had logged in could see and change everyone's data.
- How I fixed it
- The server now checks roles and permissions on every page.
Uploaded documents were public
Security Fixed- Project
- Customer portal, built with Lovable and Supabase.
- What I found
- Users' identity documents ended up in a public storage bucket. The link alone was enough to open them, without logging in.
- How I fixed it
- I made the storage private. Links now expire after a short time and each document can be opened only by its owner.
The database key was in a public repository
Security Fixed- Project
- Booking platform, written with Cursor.
- What I found
- The full-access database key sat in a repository made public by mistake, and there was no backup.
- How I fixed it
- I revoked the key in time and made the repository private. I added automatic backups and a block on secret keys.
See all 17 cases
The management app that could not talk to the ERP
Security Fixed- Project
- Production management app built with Lovable.
- What I found
- The ERP only accepted authorised addresses, but the app kept changing IP. The main database key was stored in plain text in the repository.
- How I fixed it
- A secure, logged API bridge between app and ERP, with automatic synchronisation at the end of production.
The tests that did not exist
Security Flagged in the audit- Project
- Complete management platform with an AI assistant.
- What I found
- The automated tests promised in the documentation were missing from the code. A working copy used the production database.
- What I did
- I documented the risks by priority, with an action plan.
The code in production was not the one in the repository
Security Fixed- Project
- Management app with connected devices and a new panel built with Lovable.
- What I found
- A service pointed to the test environment. The server had newer code than the repository. No document said who held the keys.
- How I fixed it
- Devices integrated into the new panel.
The prototype ran on fake data
Security Fixed- Project
- Company management app born on Lovable.
- What I found
- The prototype was convincing, but it ran on fake data with an architecture unfit for production. Candidates’ personal data had no protected storage.
- How I fixed it
- Backend with APIs and tests, installable mobile app, candidates’ data in private storage with automatic deletion.
Slow, and spending money even when idle
Fixed- Project
- AI platform that collects and classifies data from several sources.
- What I found
- The APIs downloaded far too much data and a filter found nothing. Scheduled jobs kept calling the AI, even with the project on hold.
- How I fixed it
- Leaner APIs, filter fixed, hidden costs flagged.
Every save ended up in production
Fixed- Project
- Management app with users, payments and invoicing.
- What I found
- Every change pushed to the main branch went straight to production, with no staging environment. No documented database backup.
- How I fixed it
- Integration with electronic invoicing, with credentials kept on the server only and never in the browser.
Invisible to Google
Fixed- Project
- Websites and web apps born on Lovable, including the Ailligence site.
- What I found
- The content was built in the browser. Search engines and social link previews saw an almost empty page.
- How I fixed it
- Titles, descriptions and content of the public pages rendered on the server.
Beautiful, but the data lived in the browser
Fixed- Project
- Management web app born on Lovable.
- What I found
- The app looked complete, but the data was saved only in the user’s browser, with no backend or database. Switch computer and everything was gone.
- How I fixed it
- Backend with APIs, authentication and database, and the move from demo data to real data.
From prototype to app in the stores
Fixed- Project
- Client area with a mobile app, front end born on Lovable.
- What I found
- The prototype needed the CRM and apps for iOS and Android. Meanwhile, an iPhone build shipped pointing at the development server.
- How I fixed it
- API gateway to the CRM, with retries when it does not respond. Payments on the card network's page and apps in the stores. A check blocks builds with the wrong address.
The newspaper Google News could not see
Fixed- Project
- News website born on Lovable.
- What I found
- The editorial team could not manage the site, and it was not built to be found by search engines.
- How I fixed it
- Backend with a CMS for the editorial team, role-based permissions, full-text search and a Google News sitemap.
Supabase swamped by requests
Fixed- Project
- Management app built with Lovable and Supabase.
- What I found
- One component kept re-rendering and multiplied the database calls. With a handful of users Supabase hit its limit and the app froze.
- How I fixed it
- Fewer, batched calls, cached data, real-time only where needed: usage back within the plan.
Details changed to protect the client's confidentiality.
Check your app's securityWho reads your code
I'm Giovanni Tempesta, developer and AI engineer. I have worked as a freelancer since 2018.
I have delivered over 40 projects for companies and agencies. I read the code and answer you myself.
Read more
Many of my projects started with AI tools such as Lovable. I took them into production with tests, controlled releases and documentation.
Clients who trust me
What clients say about my work
5.0 out of 5 · 10 reviews verified on Google
-
Verified on Google
We relied on this company to develop custom software and we were very satisfied with the result. They showed professionalism, competence and great willingness to listen to our needs, proposing effective, tailored solutions. The project was completed within the agreed timeframe and post-delivery support has always been quick and punctual
Translated from Italian · Read the original
Ci siamo affidati a questa azienda per lo sviluppo di un software personalizzato e siamo rimasti molto soddisfatti del risultato. Hanno dimostrato professionalità, competenza e grande disponibilità nell’ascoltare le nostre esigenze, proponendo soluzioni efficaci e su misura. Il progetto è stato realizzato nei tempi concordati e il supporto post-consegna è sempre stato rapido e puntuale
Luca Albergo · Technical and Human Resources Manager, Gate Srl -
Verified on Google
I entrusted this software and AI development agency with building an advanced web portal for my business. The result was excellent in every respect. The team designed a solid, scalable and well-documented architecture, with AI integrations that are genuinely useful. In terms of performance, the portal is fast, stable and optimised both for high loads and for the user experience. The work on security, data management and intelligent automations that reduced operating times was also excellent. The impact on the business was immediate: more customers, more efficient processes and a measurable increase in profits. A highly competent partner, with an engineering approach focused on results.
Translated from Italian · Read the original
Ho affidato a questa agenzia di sviluppo software e AI la realizzazione di un portale web avanzato per la mia attività. Il risultato è stato eccellente sotto ogni punto di vista. Il team ha progettato un’architettura solida, scalabile e ben documentata, con integrazioni AI realmente utili. Lato performance, il portale è rapido, stabile e ottimizzato sia per carichi elevati sia per l’esperienza utente. Ottimo anche il lavoro su sicurezza, gestione dei dati e automazioni intelligenti che hanno ridotto i tempi operativi. L’impatto sul business è stato immediato: più clienti, processi più efficienti e un incremento misurabile dei profitti. Un partner altamente competente, con un approccio ingegneristico e orientato ai risultati.
Salvo DF · Founder, FiscoZoom -
Verified on Google
Choosing Ailligence by Giovanni Tempesta was a turning point for our business. We needed a complex, fully customised web platform, far from the usual standard templates, and the result exceeded our expectations. The consultant proved to be a true technology partner, able to listen to our needs and turn them into a fast, secure and scalable platform. Communication was excellent and delivery times were fully met. I recommend him to anyone looking for a serious professional for unique, high-level web solutions.
Translated from Italian · Read the original
Affidarmi ad Ailligence di Giovanni Tempesta è stata una svolta per il nostro business. Avevamo bisogno di una piattaforma web complessa e totalmente personalizzata, lontana dai soliti template standard e il risultato ha superato le nostre aspettative. Il consulente si è dimostrato un vero partner tecnologico, capace di ascoltare le nostre esigenze e tradurle in una piattaforma veloce, sicura e scalabile. La comunicazione è stata eccellente e i tempi di consegna sono stati pienamente rispettati. Lo raccomando a chiunque cerchi un professionista serio per soluzioni web uniche di alto livello.
Dc Consulting -
Verified on Google
I have been working with Giovanni Tempesta of Ailligence for some time and I can confirm his great reliability. Deliveries are always on time, often even early, and every project is developed with care, professionalism and attention to detail. The products built by Ailligence are high quality, technically solid and always up to date with the latest technologies. The code is clean and well structured, which makes the work efficient and sustainable over time. I really appreciate the way Giovanni approaches every project: he does not just carry out requests, but proposes smart solutions and improvements. A serious, competent professional who is always ready to give useful advice. A truly valuable technical partner whom it is a pleasure to work with.
Translated from Italian · Read the original
Collaboro con Giovanni Tempesta di Ailligence da tempo e posso confermare la sua grande affidabilità. Le consegne sono sempre puntuali, spesso anche anticipate, e ogni progetto è sviluppato con cura, professionalità e attenzione ai dettagli. I prodotti realizzati da Ailligence sono di qualità, tecnicamente solidi e sempre aggiornati alle tecnologie più recenti. Il codice è pulito e ben strutturato, caratteristica che rende il lavoro efficiente e sostenibile nel tempo. Apprezzo molto il modo in cui Giovanni affronta ogni progetto: non si limita a eseguire le richieste, ma propone soluzioni intelligenti e migliorative. Un professionista serio, competente e sempre pronto a dare un consiglio utile. Un partner tecnico davvero prezioso con cui è un piacere collaborare.
Domenico Pascucci · Project Manager, Antea Studio -
Verified on Google
Giovanni is an extremely competent and reliable developer. He shows solid technical skills, great analytical ability and attention to detail. He tackles even the most complex challenges methodically, proposing effective and innovative solutions. Beyond his technical preparation, he stands out for his availability and collaborative attitude, which make working with him easy and pleasant. He is a valuable asset in any development team.
Translated from Italian · Read the original
Giovanni è uno sviluppatore estremamente competente e affidabile. Dimostra solide competenze tecniche, grande capacità di analisi e attenzione ai dettagli. Sa affrontare con metodo anche le sfide più complesse, proponendo soluzioni efficaci e innovative. Oltre alla preparazione tecnica, si distingue per la disponibilità e l’attitudine collaborativa, che rendono semplice e piacevole lavorare con lui. È una risorsa preziosa in qualsiasi team di sviluppo.
Luca Mangiacotti · Founder, Shellonback -
Verified on Google
I am working with Giovanni on a project for my start-up and I am sure we will keep working together for a long time. He is punctual, helpful and his work often goes beyond expectations. He is able to understand requirements and priorities quickly, also proposing more complete alternative solutions when needed. Highly recommended!
Translated from Italian · Read the original
Sto collaborando con Giovanni a un progetto per la mia startup e sono sicuro che continueremo a lavorare insieme a lungo. È puntuale, disponibile e il suo lavoro va spesso oltre le aspettative. Ha la capacità di comprendere rapidamente requisiti e priorità, proponendo anche soluzioni alternative più complete quando necessario. Consigliatissimo!
Giorgio Romano · Founder -
Verified on Google
Extremely helpful guys, quick to respond and above all honest! I recommend trusting them!
Translated from Italian · Read the original
Ragazzi disponibilissimi, tempestivi e soprattutto onesti! Consiglio di fidarsi di loro!
Gianmarco Miacola · LGM Servizi per lo spettacolo -
Verified on Google
Giovanni? Competent, prompt, skilled and serious.
Translated from Italian · Read the original
Giovanni? Competente, tempestivo, bravo, e serio.
Saverio Verna · Founder, IngrossoBio -
Verified on Google
Qualified and professional. He meets deadlines and you can count on easy communication
Translated from Italian · Read the original
Qualificato e professionale. Rispetta le deadline e si può contare su una facile comunicazione
Matteo Carlascio -
Verified on Google
Excellent!
Translated from Italian · Read the original
Ottimo!
Giorgio Taliento
Confidentiality
Your code is your work, and this is how I treat it:
- Before any access, we sign a confidentiality agreement together.
- I read the code without changing it, and you can revoke access whenever you want.
- I never touch the live app your users rely on every day, and I never see your customers' data.
- Within 30 days of delivery I delete my copy of the code.
Frequently asked questions
My app works: what's the risk?
It works in the ideal case and with few users. The check-up looks at what happens next: unprotected access, exposed data, errors as users grow.
There are free AI scanners: why should I pay?
Scanners are useful and worth using, but they only look for security holes.
The check-up also assesses architecture, data, costs and ability to grow. And a person answers you, with a plan and the costs.
I don't have GitHub, only the project on Lovable or Bolt. Is that OK?
Yes. I'll explain how to export the project or how to give me access.
Do you fix the problems?
The check-up is the diagnosis. The fixes are a separate job, at a fixed price.
If you hire me for them within 30 days, I deduct the cost of the check-up from the price.
Which technologies do you check?
All of them. AI-built apps mostly use JavaScript and TypeScript (React, Next.js, Node), Supabase and Firebase.
I also check PHP and Laravel, Python, mobile apps, databases, cloud and integrations with AI models.
What if the project is large?
I'll tell you before you pay, and suggest the right package.
Is it a penetration test or a certification?
No. It is a technical review of the code: it is not a penetration test and it is not a certification.
Check your app before it gets expensive.
Fill in the form and I'll reply within 1 working day. You only pay if I can help.