Katsa, a Plaw, Inc. company

Your AI-built app works. Make it safe to ship.

App built with Lovable, Bolt, Cursor, Supabase or Replit? We find the security holes, fix them and have a person re-test. Done in 2 business days. No call needed.

From $490 See plans and pay

Example finding. Not from a real client

High

Any signed-in user can read every order

Table orders has RLS on, but the select policy is using (true). Test account B read 100% of test account A's rows.

Fix. Scope the policy to auth.uid() = user_id, then re-test with both accounts.

Get this checked on your app
Recommended

Ship-Safe sprint

$1,500

2 business days

We find the holes. Then we fix them.

  • Supabase RLS checked with two test accounts
  • Exposed secrets flagged, with rotation steps
  • Auth flows and open endpoints tested
  • Fixes delivered on a branch or pull request
  • A person re-tests every fix
  • Written findings list you keep
Pay $1,500 and start

Full refund if we find no medium or higher issue, or if we cannot get working access within 7 days.

After payment you fill out a short intake form with your app URL, repo and access. The 2 business days start once we have working access.

Ship-Safe report

$490

1 business day

Findings only. You or your developer do the fixes.

  • Same checks as the sprint
  • Findings ranked by severity with fix notes
  • Exposed secrets flagged, with rotation steps
Pay $490 for the report

Full refund if we find no medium or higher issue, or if we cannot get working access within 7 days.

Intake form after payment. The 1 business day starts once we have working access.

Why it matters

In 2025 researchers found exposed user data in 170 of 1,645 Lovable apps they checked (CVE-2025-48757, source report). Missing Supabase row level security. Names, payment details and API keys were readable by anyone. Lovable disputes the CVE and says securing each app is the customer's job. That is the gap we cover.

A prompt can list risks. It cannot confirm a fix holds. We do that.

Example findings excerpt

Example. Illustrative format only, not from a real client.

SeverityFindingStatus
Highorders readable by any signed-in user (RLS policy using (true))Fixed in PR. Re-tested with two accounts
HighService role key shipped in the client bundleFlagged. Rotation steps sent. Key moved server-side
MediumEdge function accepts requests without a valid sessionFixed in PR. Re-tested
LowPassword reset link does not expireNoted with fix steps

Access and data handling

  • Least privilege. Read-only access is fine for the report
  • We test with our own test accounts, not your users' accounts
  • No customer data gets copied off your systems
  • At delivery we ask you to revoke our access, and we delete any credentials you shared
  • We only test the URLs, repos and systems you give us

Who is behind it

Katsa is run by Yaz Caleb at Plaw, Inc., a Delaware C corp.

A real person replies within 1 business day.

Payments processed by Stripe for Plaw, Inc., a verified Delaware C corp.

Plaw, Inc.
2261 Market Street STE 98749
San Francisco, CA 94114

hello@katsa.co

Not sure yet? Free quick check

Send your app URL to hello@katsa.co. We look at what is public from the outside and tell you if something is worth fixing. No access needed. We reply within 1 business day.

Terms in short

Best-effort review by people. No security guarantee and no warranty.

Liability is capped at what you paid. You must own the app or be authorized to have it tested.

Full refund if we find no medium or higher issue or cannot get access within 7 days.

Full terms

This is a best-effort security review by people. It is not a full penetration test, an audit certificate or a guarantee that your app is secure.

A clean report does not mean your app is secure. New issues can appear with any code change, and no review can find everything.

The work is provided "as is," with no warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, or that your app is or will be secure. To the maximum extent permitted by law, Plaw, Inc. is not liable for any indirect, incidental, or consequential damages, or for any breach, data loss, or damages before or after the work, and our total aggregate liability for any claim is limited to the amount you paid. These terms are governed by the laws of the State of Delaware, USA.

By paying and submitting the intake form, you represent that you own the app and its infrastructure or are authorized in writing by the owner to have it security tested, and you authorize Katsa to perform active security testing (including authentication and endpoint testing) strictly limited to the URLs, repositories, and systems you provide. We test only what you explicitly give us access to and nothing else. If you cannot make this confirmation, do not purchase. Email us first.

We use any access and data you share only to do this work. We store it no longer than needed, and we delete credentials and copies within 30 days of delivery. Give least-privilege, read-only access where you can, and rotate any shared credentials after we finish.

Refunds. If our review surfaces no medium or higher severity issue you can act on, we refund you in full. If we cannot get working access within 7 days of your payment and cannot resolve it with you, we refund in full. Because this is delivered work, refunds otherwise are at our discretion.

Katsa is a service of Plaw, Inc., a software company and not a law firm. Nothing here is legal advice.