For founders with real users on an AI-built app
Engineers on call for apps built with AI
You shipped fast with Lovable, Bolt or Cursor. Now vetted senior engineers keep it standing: they audit it, fix what’s broken and stay on call, from a fixed monthly retainer.
No card for the scan. Sign in with GitHub or Google.
acme-crm · Security audit
Finding 1 of 7Anyone can read every customer’s invoices
Row-level security is off on the invoices table, and the anon key ships in your client bundle. One request returns all 4,812 rows.
$ curl "$SUPABASE_URL/rest/v1/invoices" \
-H "apikey: $ANON_KEY"
→ 200 OK · 4,812 rowsFix quote
1h 30m · enable RLS, add owner policies, rotate key
How it works
Scan, audit, then fixes you approve
One loop, run by the same engineer: find what’s wrong, agree on what to fix, and pay for it from hours you already bought.
- 01
Free scan of your live app
Add your app’s URL. In about 20 seconds you see leaked keys in your JavaScript, public .env or .git files, exposed source code and missing security headers, in plain language.
Free, no card
- 02
Human audit by a senior engineer
A vetted engineer who knows your stack reviews the app end to end and writes up every finding with impact, evidence and a fix quote.
$299, credited to your first month
- 03
Fixes from prepaid hours
You approve each quote before work starts. Your engineer logs time against it, and every minute shows up in your hours ledger.
From $199 / month
No work starts without an approved quote, and you can re-run the free scan any time to check the result.
Free
Start without paying anything
- Your account, with no card
- The scan of your live app, as often as you like
- A plain-language report with a fix for every issue
When you want an engineer
Pay only for human work
- A senior engineer’s audit of your code: $299, credited to your first month
- Fixes written, tested and shipped from prepaid monthly hours
Nothing is charged until you approve a quote.
Supported stacks
We know what these tools generate
Engineers are matched to your builder and stack, so they spot the patterns each tool gets wrong.
Built with
- Lovable
- Bolt
- Cursor
- Replit
- v0
- Claude Code
Running on
- Next.js
- React
- Supabase
- Firebase
- Postgres
- Stripe
- Node.js
- Python
- Vercel
- Netlify
What we check
The gaps AI-built apps ship with
Written so a founder can act on it: “Your invoices table is readable by anyone”, not “RLS misconfiguration detected”.
Free scan
Exposed keys
Stripe, OpenAI and Supabase service-role keys shipped in your JavaScript.
Free scan
Public secrets and source
A readable .env or .git folder, or source maps that publish your code.
Free scan
Missing security headers
No CSP, no clickjacking protection, cookies without Secure or HttpOnly.
Human audit
Open database rules
Supabase or Firebase tables that anyone with the public key can read or write.
Human audit
Unverified payment webhooks
Stripe endpoints that grant access without checking the signature.
Human audit
Auth on API routes
Routes that trust a user ID from the browser instead of the session.
Human audit
No way back
No backups, no staging, no rollback when the next AI change breaks production.
Why not just ask ChatGPT?
An engineer using AI, not AI alone
Chatbots are great for questions. They can’t see your running app, can’t confirm what they find, and leave before the fix ships. We use AI to read faster and miss less, and a senior engineer signs off on every finding and every fix.
- What it sees
- Chatbot:Only the code you paste in, out of context.
- OpenKeel:Your live app from the outside, then your whole repo, read by an engineer.
- Accuracy
- Chatbot:Can miss real issues or invent ones that aren’t there. You can’t tell which.
- OpenKeel:A senior engineer confirms every finding and shows the evidence.
- The fix
- Chatbot:A patch you paste in yourself, hoping it doesn’t break something else.
- OpenKeel:Your engineer writes it, tests it and ships it, from hours you approved.
- Next month
- Chatbot:Starts from zero every conversation.
- OpenKeel:The same engineer, who already knows your app, on call each month.
- Accountability
- Chatbot:None. You own every mistake.
- OpenKeel:A written quote before work, every minute logged, and you approve each hour.
Pricing
A retainer, not a marketplace
Response time and prepaid fix hours, every month. The $299 audit is credited to your first month.
Starter
$199/ month
- Fix hours
- 2 h / month
- First response
- 48 hours
- 2 fix hours a month
- Your engineer reviews every scan
- Email support
Growth
Most chosen$499/ month
- Fix hours
- 6 h / month
- First response
- 24 hours
- 6 fix hours a month
- Monthly health report
- Shared Slack channel
Scale
$1,200/ month
- Fix hours
- 15 h / month
- First response
- Same day
- 15 fix hours a month
- Named engineer
- Emergency line
Extra hours $75 each. Unused hours roll over one month. Cancel any time.
For engineers
Senior engineer? Audit for OpenKeel
Paid per audit and per logged hour, on stacks you already know. We find the clients and handle billing; you do the careful work.
FAQ
Questions founders ask first
What’s free?
Creating an account and scanning your live app, as often as you like, with no card. The scan checks what anyone on the internet can see: leaked keys in your JavaScript, public .env or .git files, exposed source maps, security headers and cookies. You pay only for human work: the $299 audit or a monthly plan.
Why not just ask ChatGPT to review my code?
A chatbot only sees the code you paste, can’t check your running app, can’t confirm what it finds, and won’t ship or stand behind the fix. Here a senior engineer, using AI to move faster, reads your whole app, verifies every finding with evidence, then writes, tests and ships the fix from hours you approved.
What’s a “vibe-coded” app?
An app built mostly by prompting an AI tool such as Lovable, Bolt, Cursor, Replit, v0 or Claude Code. They get to a working product fast, and often ship with the same handful of security and stability gaps. That’s what we look for first.
Do you need access to my repository?
Signing in never grants repo access: we ask GitHub only for your public profile and email. For the audit, you’ll install a GitHub App on the one repo under review, read-only, and we revoke it when the engagement ends. Per-repo access arrives in v1.1; until then you can share a public repo or a read-only invite.
How are auditors vetted?
Every engineer applies with their GitHub history, the stacks they know and sample work. We review each application by hand, they sign a contractor agreement and NDA, and they only ever see projects assigned to them. Every view and action is logged.
What happens if I run out of hours?
Nothing starts without an approved quote, so you’ll never get a surprise bill. If a fix needs more than your balance, you can buy extra hours at $75 each or move up a plan.
Do unused hours roll over?
Yes, for one month. Hours you don’t use this month carry into next month, then expire.
How do you handle my secrets?
Never in chat or email. Share credentials only through the secrets vault, where each grant is tied to one audit and expires on its own. The vault arrives in v1.1; until then, engineers work without production secrets.
Can I cancel?
Any time, with no notice period. Your plan runs to the end of the month you’ve paid for, and your findings stay until you delete the project.