An open-source app. Names removed.
I audited an app built with Lovable.
An ordering app for a small cafe: menu, table bookings, card payments, a staff dashboard. React, Supabase and Stripe. I read every line of the public code.
The verdict
Fix it. No rebuild.
Good bones. A few open doors.
21
things found
2
critical: money or data at risk
3
fixes to do this week
3,000 EUR
to fix all of it
How bad is it?
- Critical: fix before the next user signs up
- High: breaks things for users
- Medium: slows every change
- Low: tidy up later
The 5 worst, in plain words
Critical
Anyone can log in as the admin.
The staff sign-in page fills in the admin email and password, and prints them under the form. Log in with them and every guest's name, phone and email is right there.
1 leaked guest list means GDPR trouble and guests who stop trusting you.
Critical
Anyone can create an order marked "paid".
The database lets any visitor write orders with any values. A short script makes an order that says "Paid online" for any total.
Every fake "paid" order is food you give away.
High
The web framework has a known critical hole.
The version in use has a published cross-site scripting advisory, and staff sessions sit where that kind of hole can steal them.
1 stolen staff session opens the whole dashboard.
High
Bots can flood the kitchen.
Orders, table requests and sign-ups have no rate limit and no bot check. A script can fill the kitchen screen with fake orders.
Fake orders bury the genuine ones, and guests wait.
High
An order can show "paid" before the money arrives.
The payment handler marks an order paid when checkout finishes, without checking the payment went through.
Food goes out for money that may never arrive.
Fix this week
- Remove the demo login and change the admin password.
- Stop visitors from writing to orders and bookings directly. Only the server writes.
- Update the web framework to the fixed version.
About 2 days of work, together.
Keep or fix?
- LoginFix
- Database rulesFix
- Ordering and paymentsFix
- BookingsFix
- Staff dashboardKeep
- DesignKeep
What it costs
Step 1, this week
750 EUR
The 2 critical holes and the bookings rule. 2 days.
Step 2, after
2,250 EUR
Payments, bot checks, password reset, tests, cleanup.
Total
3,000 EUR
Fixed price. 50% up front.
Your app next?
Same report for your app in 5 days, from 1,500 EUR. You know the price before I start. Then you decide what gets fixed.
Your report stays private. Samples use public sites with names removed.