External Exposure Report — attack surface, findings, fixes

External Exposure Report · for apps built with AI

You shipped it. Did you lock it?

bolt Early bird offer

Instead of $249 now $39

one-time · no subscription · invoice after delivery

App to check

Website / app URL *

Contact

Full name *

Email *

Report and invoice go here.

Billing address (for the invoice)

Business name (optional)

Street address *

Address line 2 (optional)

ZIP *

City *

State / region

Country *

Confirmation Right to test. I confirm that I own the website above or am explicitly authorized by its owner to have it externally assessed, and I take responsibility for that authorization. Paid order. I understand that submitting this form places a binding order and creates a paid service contract with BOLD BYTES DEV LLC for the one-time creation of an External Exposure Report at $39 USD. I have read what is and is not included.

Order with obligation to pay. No payment now — report and invoice follow within 12–48 hours.

Replit, Bolt, Cursor and Claude get you live in an afternoon. They don't tell you what you left open: keys that let anyone read your database, files that were never meant to be public, admin pages without a lock. Automated scanners test every public site, around the clock. They don't care that you're not a developer.

We check your app the way an outsider would, put every finding in plain English, and tell you exactly what to fix, in the order that matters. A real person reviews every result. Delivered in 12–48 hours.

visibility

What we do

✓ We look at your app like an outsider. No password, no insider access. Your site, its address, and everything attached to it. If it is reachable from the internet, we find it.
✓ We find the open doors. Settings files with passwords in them, backups, hidden admin pages, database exports. Things that should never be public and often are.
✓ We find what your app is handing out. AI builders love pasting secret keys straight into your site. We check whether yours are visible and what someone could do with them: read your users, edit your data, run up your API bill.
✓ We test your database from the outside. One missing setting in Supabase or Firebase and anyone can read or edit your data, no login needed. We check whether yours is open.
✓ We check the locks on the front door. Encryption, and the protections browsers rely on. Small settings, big difference, usually forgotten.
✓ We flag outdated parts. Software your app runs on with known, published security holes. If it needs an update, you will know.
✓ We tell you what to fix, in order. Every finding gets a priority, from "fix today" to "nice to have", and a short instruction you can paste into Claude, ChatGPT, Cursor or Replit. No decoding required.
✓ You get a PDF you can actually show someone. The full report plus a one-page summary for your co-founder, your client or your investor.

bug_report

What we don't do

Read this before ordering. We only look from the outside, with methods that cannot harm your app. This is a security check, not hacking.

✗ We never log in. No accounts, no password guessing, nothing behind a login screen. Ever.
✗ We don't go through open doors. If we find one, we document it. We don't enter, we don't download your data, we don't "prove" anything.
✗ We don't stress-test or flood your app. Nothing we do can slow it down or take it offline.
✗ We don't trick anyone. No fake emails, no calls to you or your team.
✗ We don't fix it for you. The report tells you exactly what to change. You, or your AI, do the work.
✗ This is not a full penetration test and not a compliance certificate (SOC 2, ISO 27001, PCI).
✗ It is a snapshot of today. Fix things, ship more, check again.

schedule

How it works

01Fill in the form. Confirm the app is yours, or that you're allowed to have it checked.
02We check your app from the outside and go through every finding by hand. No automated scanner dump, no copy-paste.
03Within 12–48 hours the PDF report and the invoice land in your inbox. Sent by a person, not a robot.
04Pay the invoice online (card or bank transfer). One-time. Done.

Check my app for $39 $249 →

No payment today. You get the report first, the invoice comes with it.