Risks

An audit is not a guarantee

An App Audit is a review of the issues I can find at the time, using the access you give me. It is not a guarantee that your app is secure or free of bugs. An app can pass an audit and still have problems nobody has found yet, and new problems can appear as you add features later.

Code written with AI tools can hide problems

Apps built with tools like Lovable, Bolt, Replit, Cursor or Claude Code can look finished while hiding weak spots, such as exposed keys, loose database rules or missing checks. Finding those is what the audit is for, but it also means the code may be harder to predict than code written by hand.

Changes can break things

Fixing one thing can affect another. That's why I work on a separate copy of your code and why nothing goes live until you have tested and approved it. Testing on your side is part of the job, and the final decision to deploy is yours.

Your backups still matter

I take or ask for a backup before I change anything, but you should keep your own backups of your code and your database too. If your app has no backups today, setting them up is worth doing before any work starts.

Timelines are estimates

Dates are my best estimate, not a promise. Delays in getting access or answers from you move the dates, and so can anything unexpected I find in the code.

AI features can be wrong and cost money

If I build an AI feature for you, it can give wrong or unexpected answers, so I add limits on what it can do on its own. It also runs on your own Claude or other AI account, so each use has a cost that you pay to the provider. I'll show you how to estimate that cost, but I can't control the provider's prices or availability.

Your keys and data

You decide what access to give me. I ask for the least I need, I never ask for your personal passwords, and I remove my access when the job is done. If a key was ever exposed in your code, treat it as compromised and replace it, even after I've removed it from the code.

Not legal, tax or compliance advice

My work is technical. It doesn't replace advice from a lawyer, an accountant or a compliance specialist, which you may need if your app handles regulated data such as health or payment information.

These points go together with the Terms of Service. Questions are welcome atmirza@my-space.io.