Keep what works.
Fix what matters.

If it’s a JavaScript or TypeScript web app, usually yes; if you’re not sure, tell me which tool you used and I’ll check. The tool matters less than what it produced. Many builders let you export your code or sync it to GitHub, which is the best starting point. Building with AI is a sensible way to test an idea; the review is about what the app needs next, not how it was made.

A short description of what the app does and what’s going wrong. For the review, I usually need read access to the code and to your hosting and database dashboards. Please don’t send passwords or keys by email; we’ll agree a safe way to share access, and it’s removed when the work ends. Where possible I work on a copy with test data. Database access often includes personal data, so we’ll put data processing terms in place first. If a former developer still holds the accounts, getting them back comes first.

It’s an engineering review. It checks common security weaknesses, such as exposed keys, loose database rules and unprotected pages, alongside reliability and code quality. It isn’t a penetration test, an audit against a standard, a certification or legal advice. If a customer or insurer asks for a formal penetration test, you’ll need a specialist tester; certification comes from a certification body, not from me. Either way, it’s worth fixing the problems you already know about first.

No. It’s an engineering review of one app, and nothing in it says whether your business meets ISO 27001 or any other standard. What it can do is feed your own work: each finding explains what could happen, how to fix it and how soon it matters, with the technical detail alongside. Certification comes from a certification body, and your own auditor’s work is separate from mine. I’m here as an engineer reviewing your app, not as your auditor or your consultant.

Automated scans are a useful first step, and worth running. Some can even apply fixes for what they find. But a scan only knows the patterns it looks for; it can’t judge whether your sign-in, payment and data rules match how your business actually works. The health check covers all seven areas, and puts the findings in plain English and in priority order, written by a person who has actually looked at your app. It also leaves you a written record you can show someone else, which a scan’s dashboard doesn’t.

I’ll tell you straight away, with the immediate step to contain it, such as replacing a key or closing public access to a table. You decide what happens next. If personal data may have been exposed, I’ll explain what I found so you can decide next steps using guidance from the Information Commissioner’s Office (ICO) or legal advice. I’m not a lawyer, so I won’t advise on whether it needs reporting.

Usually, yes. Before changing anything, I check whether fixes made outside your builder can flow back into it, and we agree where future work should happen. The handover includes notes for your AI tools, so new work is less likely to undo the fixes. I use AI tools in my own work too, while checking what they produce.

The health check is £495 for one web app: one code repository, one database project and its hosting, with the report within 5 working days of access. The clock starts once the agreed access is in place and any data processing terms are signed. If you book fixes within 30 days of the report, the full £495 is deducted from them. Fixes are quoted from the findings, so you can choose what to tackle now and what can wait. Larger apps are quoted before we start, and hosting, subscriptions and any ongoing care are listed separately. Prices in GBP. Any applicable VAT will be set out in your proposal before you commit.