SeaOtter

APP CHECK

You built it with AI. Now see what is actually in it.

It demos beautifully. That tells you nothing about whether it rebuilds, what its dependencies drag in, or whether a key is sitting in the file every visitor downloads. A machine checks all of it against your real app and reports only what it measured.

£150–600, fixed before anything runs.

Check my app

Lovable · Replit · Bolt · v0 · Base44

A REAL ONE

One app, before and after.

Every figure below is read from the sealed receipts of a real check and the rescue that followed it. Nothing here is an illustration.

Rebuild from a clean copyBefore: exit 1 — it could not be rebuiltAfter: exit 0
Dependency advisoriesBefore: 35After: 0
Credentials in the bundleBefore: 3After: 0
Journeys driven in a real browserBefore: 1 of 3 failingAfter: 3 of 3 passing
Errors on loadBefore: an uncaught error, on the booking pathAfter: cleared

Accepted — 41 of 42 lines closed, 0 regressions. wavelength 0.1.0 → 0.2.0

The 42nd line is still open: one console message the fix did not clear. It stays on the record as open, because it is.

THE PART THAT MATTERS

The first fix was refused.

The obvious repair was to move every pinned dependency to its latest version. The re-measure refused it — that change pulled in four new high and critical advisories. Nothing was paid for it.

Move every pin to latest

re-measure: 4 new high and critical advisories introduced

Remove the dependencies instead

axios, follow-redirects and lodash out; minimist and json5 moved to versions that measure clean

A person reading that diff would have shipped the first one.

WHAT GETS CHECKED

Five things, measured on your real app.

  • Does it rebuild?

    We rebuild it from a clean copy and record what the build actually did. An app that only exists on the platform that made it is a problem you want to find early.

  • What do its dependencies drag in?

    Every exact pin, read against live public advisory data at the moment of the check — never a bundled copy that has quietly gone stale.

  • Is there a key in the bundle?

    The files your visitors can already download, read for credentials. A key in the browser bundle is not at risk of leaking; it has already leaked.

  • Do the real journeys work?

    The things a customer actually does — browse, book, pay — driven in a real browser and recorded, not asserted.

  • What happens on load?

    Console errors and requests that failed, captured as the page runs.

A check that could not run is named as missing and the result says so. It is never shown as a pass, and we never tell you an app is safe — only what was measured, and where.

HOW IT RUNS

Priced first. Paid on what closes.

  1. 1A fixed price is agreed before anything runs — £150–600, depending on how much app there is.
  2. 2You get what was measured, with the exact file, package or journey behind every finding.
  3. 3Anything that failed becomes a Done-when list at its own fixed price. You can stop here and take it to your own developer.
  4. 4If we fix it, each line closes only when the same check, re-run over the new files, no longer reports it. Lines that do not close are not paid for.

AFTER THE FIX

The check is the door, not the destination.

Most people arrive here because something is broken and it is urgent. That part is usually small. Once the app measures clean, the work that actually compounds is the dull kind — the step someone repeats every morning, the two tools that will not talk to each other, the report nobody has time to build.

Same fixed price, same checked-before-paid contract, same team — who now know your app.

Start with the check

Point it at your app.

One address is enough to get a price.

Check my app

Fixed price before anything runs · you see what was measured · unclosed lines are not paid for