Cases · App check
An online shop built with AI, checked and fixed
A sample engagement: the shop is fictional and holds test data. It was built with Claude Code for this case; every finding, test and fix is a real run.
Goal
Apps built by describing them to an AI look finished long before they are safe to take money. The question: what does a check find in a shop that passes a normal walk-through and that its builder handed over as done?
Challenge
Where people usually look, the shop held up: prices, stock and totals were right, and nobody could read another customer's data from outside. The builder's own answers said "Orders can't be placed twice". What was wrong only showed under a dropped connection, a slipped digit in an amount, or two things happening at the same moment.
Solution
A copy of the shop ran locally on test data, with card payments against a stand-in for Stripe and once against Stripe in test mode. First an automatic scan of the access rules, then four independent reviews by separate sessions that had not seen each other's work: from outside with the public key, the code and the database, the owner and customers in a browser, the installed app offline. Every finding became a test that fails on the shop as received; each fix was then reviewed by sessions that had not written it.
Outcome
26 findings: 3 high, 9 medium, 14 low. After a dropped connection the next customer on the same device was shown someone else's order and address; the owner could record a €500 refund on a €29.99 order; a customer could pay €27.99 by card for an order already cancelled and not get the money back. 40 of 48 tests failed on the shop as received, none after the fixes. 22 findings are fixed; 4 low ones are left to the owner, with the reasons. Reviews of the fixes found more, part of it brought by the fixes themselves; those rounds are outside these numbers. One shop, built once: the numbers describe this shop, not a rate for apps built this way.
From the case
The report, 18 pages (PDF)
Service
The same check for your app
You send the code, not your passwords. Every problem found becomes a test, and every fix is reviewed for what it broke.