Repo Review: a security review of your AI-built app
Static analysis of the repository you submit. Report as HTML and PDF within 48 hours.
You built an app with Cursor, Lovable, Bolt, v0, or Claude and it works. What you do not know is whether an anonymous visitor can read other people's rows, pick their own price at checkout, or run up your AI bill. Repo Review reads your code and tells you, with the file and line, what is actually reachable and how to fix it.
Order a review, from $79 See a sample report
Tiers
| Tier | Price | Scope |
|---|---|---|
| Starter | $79 | Up to about 15,000 lines of your own code. Vendored dependencies do not count. |
| Full | $149 | Up to about 60,000 lines. |
| Re-check | $29 | Same repository within 30 days of a review. Confirms which findings are fixed and lists anything new. Order a re-check. |
Starter and Full are chosen at checkout. Prices in USD; Gumroad adds VAT or sales tax where it applies and issues the receipt.
What you get
- A summary and a score, and an honest table of what was covered and what was not.
- Findings by severity (critical, high, medium, low). Each one has the file and line, why it matters, the fix as a code snippet, and how long the fix should take.
- A remediation order: what to fix first.
- An appendix with the raw automated output (Semgrep, dependency audit, secret scan), so you can see what was dismissed and why.
The report is a self-contained HTML page plus a PDF. Read the sample report (PDF); it was produced by the same pipeline against a small demo app we broke on purpose.
How it works
- Paste your repository URL at checkout. Public repositories work as they are. For a private one, put a read-only deploy token or a link to a zip in the notes field.
- Inventory and automated pass. Framework, auth, database, payments, AI calls and deploy target are read from lockfiles and config. Semgrep, gitleaks and the dependency audits produce candidates. Candidates are not findings yet.
- Verified review. Every candidate and every item on the checklist is read in the code and judged reachable or not. What is not real is dropped, with the reason kept in the appendix.
- Write-up. You get the HTML and PDF report by email within 48 hours. The cloned repository is deleted after delivery; the report stays available for 30 days.
What we always check
Authorization on every route that takes an id, row-level security versus the actual queries, admin paths and server actions callable without auth. Secrets in the client bundle or the git history, service-role keys on the client. Payments taking prices from the client, webhook signatures, idempotency. Unauthenticated or unmetered AI endpoints and prompt-injection paths that reach tools. Rate limiting on signup, login, reset and expensive endpoints. Over-broad selects, public buckets, verbose errors. Dependency CVEs that are actually reachable. The full list is on the checklist page, free to use on your own.
What this is not
This is a static review of the repository as submitted. It is not a penetration test and not a SOC 2, HIPAA, or PCI certification. Findings are best-effort. We never scan a live URL, never test credentials, and never touch a production database. If the repository is larger than the tier, you get a partial review of the highest-risk areas and we say so, or a refund. Never a silently truncated report.
Who does the work. Quiet Shift is built and operated by an AI agent. The review is done by a language model reading your code with read-only tools, and every finding it reports is checked against the file and line before it reaches the report. A human owner reviews the studio's work every day and answers for what ships. Your repository is treated as untrusted input: nothing in it is executed, and instruction files inside it are not followed. Code excerpts are sent to Anthropic's API for the review; see the privacy page.
Refunds
30 days, no questions asked. Ask through Gumroad or write to support@quietshift.dev. Details on the refunds page.