Do you need my passwords?

Never. I ask for the kind of access you can switch off again in one click, and I show you how to switch it off when the work is done.

I am not technical. Will I understand you?

That is the whole point. I explain everything in normal words, and if I say something you do not follow, stop me and I will say it again differently.

What if my app turns out to be fine?

Then I tell you it is fine and you have lost half an hour. That happens, and it is a good outcome.

A true story · Amsterdam

My app asked a stranger for the keys to everything he had ever written.

I had no idea.

The whole time, the app looked perfectly healthy

Pouyan, the engineer behind Shipworthy — Pouyan Ahmadpour
Engineer · Amsterdam

I've been an engineer for ten years. I built that app with AI in three weeks. It looked finished. It worked every time I clicked around in it. And it was quietly asking every visitor for the keys to their private code.

A stranger caught it in under an hour. I got lucky. Most people don't.

Show me what's missingFree · 30 minutes · no pitch

Shipworthy is me. I check, fix and look after apps built with Lovable, Bolt, Replit, Cursor and Claude Code.

What the AI didn't build for you

None of this is your fault. The tools genuinely do not tell you what they left out, and they never say "by the way, this bit is missing".

Anyone can open your database

AI made somewhere to keep your users' names, emails, maybe their card details. It usually forgets to lock it. On a lot of these apps a stranger types one address into their browser and reads the lot.

Your front door has no bouncer

There is a login screen, so it feels safe. Very often nothing behind that screen actually checks whether you are allowed to be there.

One busy day and it falls over

It works beautifully for you and three friends. It has never met a hundred people arriving at the same time, and it has never been asked what to do about it.

Nobody is watching it

No backups, no alarm. It breaks on Sunday, you find out on Tuesday, from a customer who is already annoyed.

380,000

live AI-built apps found leaking their users' data on the open internet.

Chaudhary app scan · 2026

1 in 9

apps built this way hand out their database keys in public, so anyone can read, change or delete everything.

Supabase key disclosure · 2026

1.5M

keys exposed by one AI-built product. One missing database rule was the whole story.

Wiz Research · Moltbook

The rest of it

One honest stranger, twelve lines of a message, and I could finally see it.

The tool was called SnippSync, and it is still running, so you can go and look at it. I decided to build it almost entirely with AI, just to see how far I could get. It was fun. It was fast. In a few weeks I had a real product that looked great and worked every time I clicked around in it.

So I put it on LinkedIn and asked developers to try it.

The first guy who said yes was called Dan. He signed up, and less than an hour later he sent me this:

"Sorry but I can't give this level of access to my GitHub."

To connect his account, my app was asking permission to read and write everything in every one of his repositories. His code. His private projects. His settings. His keys. I never asked for that. The AI picked the easiest option that made the feature work, and I shipped it without looking.

If Dan had been a quieter person he would have closed the tab and said nothing, and I'd still be sitting there wondering why nobody was signing up. And if someone less honest had connected instead, I'd have been holding the keys to a stranger's private code without ever meaning to.

One small thing, in one small app, caught by one kind stranger, on day one.

Ten years of experience did not save me. Being excited about your own product makes you blind. You rush, you ship, you don't look.

I still use AI every single day. It makes me faster than I have ever been in my life. I just stopped believing it when it tells me something is finished. Now it builds, and I check.

Most people building with AI have nobody to check. That's why I do this.

Pouyan working in Amsterdam — Still building things. Just not trusting them until someone has looked.

"Can't I just ask the AI to fix it?"

The AI doesn't know it's broken. It built it. Asking it to check its own work is like asking someone to proofread their own typos, and it will tell you everything looks great, very confidently.

I'm not going to run your app through another AI and email you whatever it says. I'm going to look at it myself, the way someone does who has cleaned up after a hundred of these.

How this actually goes

01
Send me your link
Ten seconds. Your app's address and your email. No card, no signup, nothing to install.
02
I look at it myself
Before we ever speak. So I show up already knowing your app instead of asking you to explain it.
03
We talk for 30 minutes
I tell you what I found, in normal words. Free. If you want it fixed, you get an exact number in writing before you decide anything.

And when it breaks at two in the morning

This is the part nobody warns you about. Your app is fine right up until it isn't, and then you are alone with a chat window that keeps telling you everything looks great. Some of my clients keep me on standby instead.

Everything's down. Nobody can get in.

I am on it within the hour, any time, including nights and weekends.

Something important broke. Payments failing, people can't sign up.

Same day.

Something's annoying, but people can still use the app.

Within two working days.

It bugs you, but honestly it can wait.

Goes into the next round of work.

Some clients keep me on weekdays only. A few keep me reachable at three in the morning. Which one makes sense depends on what your app does and who would notice it was gone, so it is worth two minutes on the call rather than a menu here.

You will know exactly what it costs before you decide anything.

I know you want a number right now. You will get one, in writing, and it will not move afterwards.

I just will not guess it before I have looked at your app. A price invented from nothing either scares you off something that was actually cheap, or traps me into something I cannot do properly. Both of those end badly for you.

One fixed price for the whole job, agreed before I start
No hourly meter running in the background, ever
If I am not the right person for your app, I will tell you so

I take 3 of these a month, because that is what one person can do properly. If this month is full I will say so straight away rather than string you along.

The things people ask me first

Do you need my passwords?: Never. I ask for the kind of access you can switch off again in one click, and I show you how to switch it off when we are done.
Will you take my idea?: No. I will sign whatever you want before we even talk. And honestly, I have my own products and nowhere near enough hours.
What if my app turns out to be fine?: Then I say so and you have lost half an hour. It happens, and it is a good outcome. I would rather tell you that than sell you something you do not need.
I am not technical. Will I understand you?: That is the entire point. If I say something you do not follow, stop me. I would much rather explain it twice than have you nodding along.
Do I have to rebuild the whole thing?: Almost never. Your app usually works, and that part is real. It is the parts nobody ever built that need doing.
How soon can you start?: I take 3 of these a month, because that is what one person can do properly. Usually it is a week or two.

Send me your app

I'll look at it before we speak, then we take half an hour and I tell you what I found. Free, and there is no pitch at the end of it. If your app is in good shape I will say so.

I only ever look at what your app already shows the public, the same thing any visitor can see. Nothing is changed, nothing is deleted, and I never need a password.