# Checked & Fixed

> Checked & Fixed (https://checkedandfixed.com) is a UK security check for apps built with AI app builders such as Lovable, Bolt, Replit, Cursor and v0. We look at your live app from the outside, the way a stranger would, and tell you in plain English what is exposed and how to fix it. Prices are in GBP. Run by Seamus Anderson, UK.

## Plans
- Free mini-check: we email you 3 quick findings about your app. Request it via the form on the homepage.
- Checked, £79 one-time: a fully automated, agent-run check. You get a plain-English report, copy-paste fix prompts for your AI builder, and one free re-check after you've made the fixes.
- Checked & Fixed, £149 one-time: everything in Checked, plus we make the fixes for you. You approve a plain-English summary before any fix ships. High-risk changes are never applied automatically; you get step-by-step instructions instead. Re-check included.

## What we check (read-only, non-invasive)
- API keys and secrets exposed in front-end code
- Open databases, e.g. Supabase tables with Row Level Security off, or Firebase with open rules
- Missing security headers (CSP, HSTS, etc.)
- Exposed .env files, source maps and admin routes
- Authentication basics
- HTTPS and cookie flags

## Rules and limits
- We only check apps the customer owns or controls, and they must confirm this before we start.
- Checks are read-only and non-invasive. We do not attack, load-test or change your app.
- This is not a penetration test and we cannot guarantee an app is secure.
- Reports are emailed within 24 hours on UK business days.

## Contact
- Email: hello@checkedandfixed.com
- X: https://x.com/checkedandfixed (@checkedandfixed)
- Terms: https://checkedandfixed.com/terms.html
- Privacy: https://checkedandfixed.com/privacy.html