AI App Launch Audit · Fixed price, quoted up front
Cursor & Claude Code Security Audit
Built your app with Cursor or Claude Code? You own the repo, the stack and the hosting, so you also own every risk in them. Our senior Brisbane-led team reviews AI-written codebases before launch: dependencies, secrets, auth, data access, infrastructure, and the code nobody on the team has fully read.
Fixed price, quoted up front
Free 30-minute engineer chat
Senior human review, not another AI pass
Any stack, any host
Findings in plain English
Fix it yourself or we fix it
Where AI-written codebases go wrong
What goes wrong in apps built with Cursor and Claude Code
Cursor (by Anysphere) and Claude Code (by Anthropic) write code into your own repository. There’s no platform holding your database rules or hosting settings, so the risks sit in your stack. They’re the same risks as any software, arriving faster than anyone can review them.
Packages that don’t exist (or shouldn’t)
A 2025 USENIX Security study found code models regularly suggest package names that don’t exist. Attackers register those names (“slopsquatting”). Every new dependency needs a human check.
Secrets committed to git
Keys pasted into a config file to get something working, then committed. Once a secret is in git history, deleting the file doesn’t remove it. It needs rotating.
Authorisation that trusts the browser
Sign-in works, but the API happily returns any record if you change an ID. This is the most common serious issue in AI-written apps: broken access control, number one on the OWASP Top 10.
Injection and unsafe input
Raw SQL built from strings, unescaped HTML, file paths from user input and unchecked webhooks: classic bugs that AI reproduces confidently.
Tests that test nothing
AI-written tests that mock everything, or were adjusted until they passed. A green build doesn’t prove the critical workflows actually work.
Infrastructure written in a hurry
Dockerfiles, cloud config and CI pipelines generated to “just deploy”: open ports, public buckets, debug mode in production and overly broad cloud permissions.
Agent permissions on your machine
Both tools can run commands and connect to MCP servers. Claude Code’s permission rules and Cursor’s run modes control what runs without asking. Loose settings put production credentials one prompt away.
Code nobody fully understands
When the original author was an agent, nobody can explain why it works, so nobody can safely change it. That’s a maintenance and handover risk as much as a security one.
Why these apps are different
Your tools are great. The review step is what’s missing
Cursor and Claude Code are excellent tools; we use AI coding tools ourselves. The difference between a fast build and a safe launch is an experienced engineer reading what was produced, with time to ask “what happens if…?”. Asking the same AI to review its own work tends to repeat its blind spots.
01
Read every important path
We trace sign-in, payments, data access and file handling through the code, not just the pages a demo shows.
02
Check the supply chain
Every dependency is checked for existence, reputation, licence and known vulnerabilities, along with how it’s pinned and updated.
03
Review the agent setup too
Rules files, MCP servers, auto-run settings and the credentials on the machines that run them, because that’s part of your attack surface now.
04
Make it maintainable
We flag the code that will hurt the next developer, so your app can be supported after launch, not just shipped.
Cursor and Claude Code pre-launch checklist
9 things to check before you ship an AI-written app
Every item is part of our audit for Cursor and Claude Code projects, alongside the 100+ general checks in our AI App Launch Audit.
Check 01
Every dependency is real and needed
Check each package exists, is the one you meant, is maintained, and is pinned in a lockfile.
Check 02
Git history is clean of secrets
Scan the full history, not just the latest commit, and rotate anything that was ever exposed.
Check 03
Server-side authorisation everywhere
Every API route checks who is asking and whether they’re allowed this specific record.
Check 04
Input is validated on the server
Never rely on the front end alone. Use parameterised queries and escape output.
Check 05
Tests cover the money paths
Sign-up, sign-in, payments and data export are tested without mocking away the bits that matter.
Check 06
Production is set up for production
Debug off, error details hidden, HTTPS enforced, CORS and cookies set deliberately, and logging and alerts switched on.
Check 07
Cloud permissions are least-privilege
The app’s credentials can do what it needs and nothing else. No admin keys in the app.
Check 08
Agent permissions are deliberate
Review allow and deny rules, MCP servers and auto-run settings. Keep production credentials off agent machines.
Check 09
Someone can explain the code
At least one person can walk through the architecture and the critical paths without asking the AI.
If the honest answer to the last check is “no”, and the codebase has grown past the point anyone wants to touch it, our software project rescue service may suit you better than a launch audit.
How we audit a Cursor or Claude Code project
How the audit works
Because you own the stack, we review the whole thing: code, configuration, infrastructure and the way it’s built and deployed.
1. Repo access and scope
Read-only access to the repository and a test environment, plus a short brief on who uses the app. We agree the price and scope up front.
2. Automated groundwork
Dependency, secret and static analysis scans give us a map of the codebase and the obvious issues, quickly.
3. Senior human review
Engineers read the critical paths, test the running app as real users and as attackers, and review the infrastructure and agent setup.
4. Report and re-check
A ranked, plain-English report with fix guidance or prompts for Cursor or Claude Code. Once fixes are merged, we check again.
Pricing
What a Cursor or Claude Code audit costs
Fixed price, agreed before we start. No hourly meter running while we read your code.
Free consultation
$0
30 minutes
Tell an engineer what you’ve built and who it’s for. If it’s ready to launch, that’s the answer you’ll get.
- Talk to an engineer, not a sales rep
- Mutual NDA on request
- An honest view of whether you need an audit
Most popular
AI App Launch Audit
Scoped to your app
Quoted
ex. GST, fixed price
A senior review of your AI-written codebase, dependencies, auth, infrastructure and agent setup, with a ranked, plain-English report.
- Senior human review of code, configuration and data access
- Findings ranked by risk, in plain English
- Fix guidance or AI prompts for each issue
- A re-check once fixes are in
Fixes and launch
Quoted
only if you want us to
Prefer we fix what we find? We quote the work after the audit, so you can choose between doing it yourself, a split, or handing it over.
- Fix it yourself with our guidance
- Or our team fixes it for you
- Help getting live and monitored
Prices exclude GST. The final audit price depends on the size of the app and is agreed in writing before we start. Still building and want ongoing help instead? See the AI Build Partner, a separate monthly product.
Client stories
What our clients say
Bianca
OnSchedule
“Working with Code Squirrel has been a fantastic experience! Their team is not only incredibly skilled but also highly responsive and professional. They took the time to understand our requirements and delivered exceptional results.”
Emma
Fliit
“Code Squirrel effortlessly understood our requirements and delivered exceptional outcomes. We now have our systems integrated removing hours of data entry and improving our management reporting capabilities. The team are great to deal with, transparent, responsive and highly skilled.”
Built with something else?
Audits for every major AI app builder
The risks change with the platform. Each of these pages covers what goes wrong on that tool and what we check. Not sure where to start? Read our vibe-coded app launch checklist.
FAQ
Cursor and Claude Code audit questions
Is code written by Cursor or Claude Code safe for production?
It can be. These tools produce good code quickly, but they also reproduce common mistakes confidently and can’t judge your business rules. A human review before launch is what turns fast code into code you can trust with customer data.
Can’t we just ask the AI to review its own code?
It’s worth doing, and it catches some issues. But a model reviewing its own output tends to share the same blind spots, and it can’t test your running app or question your requirements. An independent senior engineer gives you a second, different set of eyes.
Which languages and stacks do you audit?
Mainstream web and mobile stacks, including JavaScript and TypeScript (Node, Next.js, React), Python, PHP and Laravel, and the databases and clouds they typically run on. Tell us your stack in the free chat and we’ll confirm the fit.
Do you review our Cursor and Claude Code setup as well?
Yes, if you want us to. We look at rules files, MCP servers, auto-run and permission settings, and which credentials are reachable from agent sessions.
How much does an audit cost?
The AI App Launch Audit is a fixed price, quoted for your app and agreed before we start. Fixes are optional and quoted separately.
What if the codebase is beyond saving?
We’ll tell you honestly. Sometimes the right answer is a targeted fix list; sometimes it’s a planned rebuild. Our code audit and project rescue services cover the bigger cases.
Can you keep an eye on the app after launch?
Yes, through a separate product. If you're still prompting new features into your app with Cursor or Claude Code, our AI Build Partner puts an engineer across it on a steady rhythm: they review what changed, build and fix alongside you, and release it to production monthly or fortnightly. Plans start at $1,800 a month ex. GST, with a three-month initial term and then month to month. The audit fee isn't credited against a plan; they're separate products for different needs.
Get your AI-written code checked by humans.
Book a free 30-minute chat. Tell us what you’ve built with Cursor or Claude Code, and we’ll tell you honestly what an audit would cover.
