Lockward Security · LWSA-001 · Rev A

You built it
with AI.
We lock it down.

Security engineering for apps built with Lovable, Bolt, Base44, Replit and Cursor. Remote, working US and UK hours.

Who we really are

48 haudit turnaround

≥ 3real issues or a refund

$0to start

AI builders get you to a working app fast. They don't check who can read your database, whether your emails reach the inbox, or whether your privacy policy matches what the app does. We check your app from the outside for free, audit it in 48 hours with your permission, and fix what we find at a fixed price, in your existing code.

Start a brief

01

Services

Four fixed-price parts. Start free, stop whenever you like.

LW-0

Outside check

We look at your app the way any visitor, Google and a mail server would. No logins, no probing. You get the issue count and the ones that matter most.

Free

LW-1 · Founding clients: 3 spots

Launch Audit

With your written permission and read-only access: database rules, auth, payments, secrets, email and legal pages. Report ranked by cost, plus a walkthrough video, in 48 hours.

$249 $99 for our first 3 clients, for a short testimonial

LW-2

Fix Sprint

We fix what the audit found, in place. No rewrites. Fixed scope and price agreed upfront, 5–10 working days, 50% upfront. The audit fee is credited if booked within 14 days.

from $1,000

LW-3

Care Plan

Up to 8 hours a month of checks, updates and fixes, so new features don't reopen old holes. Cancel anytime.

from $400/mo

02

Process

Everything your app exposes, wired through one audit.

Schematic: six inputs from your app flow through check, audit and fix stages to a report, walkthrough, fixes and monthly care. INPUTSOUTPUTS DOMAINdns · headers APPpages · bundle DBrules · policies PAYstripe · webhooks MAILspf · dkim · dmarc LEGALprivacy · terms LW-1 audit "your-app" CHECKoutside · no access AUDIT48 h · read-only FIXfixed scope, in place scope.md · 1 page RPTranked report VIDwalkthrough FIXpatches, in place CAREmonthly re-check LOVABLE BOLT BASE44 REPLIT CURSOR Builders shown are examples.
Figure 1. What goes in, what you get back.
  1. A

    Check

    Free, from public information only. You see the issue count before you spend anything.

  2. B

    Audit

    48 hours, read-only access, written permission first. Every finding ranked by what it costs you.

  3. C

    Fix

    Fixed scope, in your existing code. Your app keeps working the way you built it.

  4. D

    Care

    Monthly re-checks so new features don't reopen old holes.

03

What we find

The same gaps show up again and again. Most stay invisible until a customer, an attacker or a regulator finds them first.

CodeFailureWhat it costs
F-01Database rules let one user read or change another's recordsCustomer data, and paid credits anyone can top up
F-02Sender records block your own email providerReceipts and replies quarantined as spam
F-03No spoofing protection on your domainFake "payment failed" emails that look like you
F-04Legal pages that don't match what the app doesFailed buyer reviews, regulator exposure, lost disputes
F-05Search engines see a blank shellYour content never ranks
F-06Sign-in and checkout pages can be framed by other sitesUsers tricked into clicks they didn't mean

04

Field notes

Real findings from live apps, checked only from the outside. Names withheld.

UK data marketplace · F-02

Its own sender record blocked the email provider it actually used.

Email ran on Microsoft 365, but the domain only allowed a different provider and hard-failed everything else. Emails to venues and buyers were set up to fail.

US media company · F-03

Its email reports went to the app builder, not its own team.

A company selling paid memberships, where nobody inside could see who was sending mail in its name.

Restaurant POS · F-04

Sold to restaurants on terms written for one restaurant's diners.

Liability capped at "the amount paid for the specific order", for software running other businesses' card payments.

05

Handling and safety

  • We never test your app without your written permission.
  • Outside checks use only what any visitor can see.
  • Read-only access first. Credentials are removed when the job ends.
  • Happy to sign your NDA.

06

Who you work with

Lockward is run by Md Shihab Hossain, a software engineer who builds and audits full-stack apps on Next.js, Supabase/Postgres, Stripe and LLM APIs. You talk to the person doing the work.

github.com/shihabcodes

07

Questions

Which tools do you work with?

Lovable, Bolt, Base44, Replit, v0 and Cursor or Claude Code projects, usually on Supabase or Firebase with Stripe.

Do you need access to my code?

Not for the outside check. For the audit, read-only access to your database settings and repository is enough. You can revoke it any time.

Will you rewrite my app?

No. We fix issues in place, so your app keeps working the way you built it.

What if you don't find anything?

If the audit turns up fewer than 3 meaningful issues, you get a full refund.

Find out what's open
before someone else does.

Book a 15-minute call