The AI-staffed IT department for vibe-coded apps
Keep building.
We’ll keep it running.
You shipped a real app with AI - and now real people depend on it. Hooldur audits what you built and tells you the truth about it - read-only, on the accounts you already own - then asks one question: what should your IT department take off your plate next?
You bring a live app
Built with Claude Code, Cursor, or Lovable. Real users, or about to have them.
Connect, read-only
GitHub, Supabase, and your domain. We only ever read - nothing changes, ever.
Your crew scans it
Reads the code like a staff engineer - secrets, access rules, backups, costs.
Plain-English report
Graded worst-thing-first. “A stranger can read your users today,” not jargon.
Fix it, run it again
Every finding ends in a fix and an effort estimate. Audit daily until it's clean.
The front door · free, instant
An audit that tells you the truth
Eleven checks on the things that actually burn vibe-coded apps, graded by what could happen to you - not by jargon. Worst thing first, and every finding ends in a fix.
Production readiness · leadloop.app
4 critical · 2 high · 3 medium
The one thing to know
Right now, anyone who opens your site can read every row of your customer table - names, emails, and the notes your users typed - straight from the browser. No login required.
Your database has no access rules
Two tables (profiles, orders) are wide open - the public key in your app can read and write them. This is how the Lovable data leaks happened.
→ Turn on row-level security, scope every table to its owner
A secret key is shipped to every visitor
Your Stripe secret is bundled into the front-end JavaScript (…4a2f). Anyone can read it in devtools and charge on your account.
→ Move the call server-side, rotate the key today
No backups you could restore from
Point-in-time recovery is off. One bad edit - including one an AI makes - and the data is gone, like the “it deleted my 200 entries” stories.
→ Enable PITR, add a nightly export, test a restore
The checklist
The eleven things that actually burn these apps
Not a 400-line linter dump. Every check exists because it has already cost a builder like you their data, their users, or their weekend - and the report says plainly when one could not run.
- 01
Secrets committed to the repo and its history
The API key you deleted last month is still in the history.
- 02
Secrets that ship to the browser
Keys bundled into front-end JavaScript, readable in devtools.
- 03
Database access rules
Missing or inverted row-level security - the classic data leak.
- 04
Whether your backend checks who is calling
Public write access, open endpoints, auth that trusts the browser.
- 05
Injection and unsafe handling of user input
The string a stranger types becoming a query you never wrote.
- 06
Backups and whether you could recover
Could you actually restore if an AI edit wiped a table?
- 07
Known vulnerabilities in your dependencies
Known CVEs and dangerously outdated packages.
- 08
Whether you would know if it went down
Would you find out from an alert, or from an angry user?
- 09
Deploy configuration and what your errors reveal
Debug mode in production, stack traces shown to strangers.
- 10
Your domain, its certificate and how it is served
Expiring certificates, missing HTTPS, absent security headers.
- 11
What a stranger could run up on your bill
The unmetered endpoint that turns into a $3,000 bill.
Why Hooldur
We operate your app where it lives
You already escaped one walled garden. You should not have to migrate into another one just to sleep at night.
Scoped accountability, stated up front. When Hooldur takes the watch, we are accountable for configuration, security, response, and recovery - not for Vercel's or Supabase's uptime. The promise is simple: you will never face an incident alone, and misconfiguration is on us.
Pricing
The audit is free. What comes next is up to you.
The paid tiers are not live yet - they are the question we ask everyone who runs a free audit: which of these would you pay for? Your answer decides what we build first.
No prices on purpose. The audit ends by asking what you would pay for - that is the research.
Questions