Browse categories
English
$
USD
Connect to your AI
I will audit and fix security holes in your lovable or supabase app
Anupa
Top Rated
About this gig
Most AI-built apps ship with the database open to anyone who opens the browser console. Supabase tables with row-level security off or set to allow everything, API keys in the frontend bundle, admin routes protected only in the UI.
I test your Lovable, Bolt, Replit or Base44 app the way an attacker would look at it, then fix what matters. No rebuild.
WHAT YOU GET
- Security Scan: RLS policies tested as a guest and as a logged-in user, leaked keys including git history, client-only auth checks, CORS and rate limits. Written report ranked Critical to Low
- Scan and Fix: every Critical and High finding fixed and retested, with before and after evidence
- Launch-Ready: plus security headers, backup check, monitoring, a signed report you can show investors, and a target AWS architecture
WHY ME
Top Rated. 600+ projects delivered. Senior DevOps engineer on live SaaS platforms. Every delivery ends with an acceptance checklist we walk through on a call.
NOT INCLUDED
- New features
- Attacking systems you do not own
- Mobile apps
Get to know Anupa
Anupa
Production cloud on AWS, Azure and GCP with migrations, DR and FinOps audits
Top Rated
- FromSri Lanka
- Member sinceOct 2017
- Avg. response time1 hour
- Last delivery1 day
Languages
Sinhala, English
I architect and run production cloud infrastructure on AWS, Azure, GCP and DigitalOcean. 600+ projects delivered for founders and engineering teams.
Four things I do: build production environments with Terraform, migrate live workloads with zero-downtime cutovers and tested DR, cut cloud bills through FinOps audits, and get AI-built apps onto infrastructure that holds.
Recent: Laravel to AWS multi-AZ with no downtime, a MySQL migration with compliance report, IoT fleet architecture.
Every delivery ends with an acceptance checklist we walk through together before I mark it complete.
My Portfolio
Other Vibe Coding Services I Offer
FAQ
Will you make me rebuild from scratch?
No. I harden what you already have. If a part truly needs rewriting, I say so in the report with a fixed price, and you decide.
Is my users' data already exposed?
The scan answers that with evidence: I query your database as an anonymous visitor and as a normal user and show exactly what each can read or change.
Lovable already has a security scanner. Why pay for this?
Built-in scanners mostly check that a policy exists, not that it actually restricts anything. A policy that allows everyone still passes. I test real access, not settings.
Will the fixes break my app?
Fixes go to a staging copy first, then production after a retest, with a rollback plan. You see before and after evidence for each one.
Do you build new features?
No. This gig covers security and production readiness only. For moving the app onto AWS, see my vibe-coded app deployment gig.
Do you need my passwords?
No. You add me as a collaborator with limited access, or create a scoped key from a short guide. Remove it after delivery.
How do I know it actually works before you mark the order complete?
Every delivery includes an acceptance checklist written against your requirements. I run it myself first, then walk you through it on a call. The order is not delivered until you have confirmed each item.
Who actually does the work?
I do. Every order is delivered by me personally. If a project ever needs a second pair of hands I tell you before the order starts, and I stay accountable for the outcome either way.
