Automated code review for AI-built apps

Me make app. App work. Me code good?

You don't need to understand every line. But a working app deserves a second look.

MeCodeGood reads your app's code, flags potential problems, and explains what to fix first, with clear instructions to take back to your AI coding tool.

Check me code See a sample report

Reviews code only, not the running app. A clean report isn't a guarantee of security.

Thunk, and his good friend Flint.

Meet Thunk. He make app.
Meet Flint. He make code.
Thunk ask Flint if code good.
Flint say yes.
Thunk suspicious.

You now software engineer? …Maybe not yet.

AI writes code. You push buttons. Things happen. Sometimes the right things.

An app that works isn't the same as knowing what's in the code. Is a secret key sitting in the browser? Can one user read another user's data? Your AI says it's fine. It always says it's fine.

How it works

AI wrote code. Me check code.

Three steps, a few minutes, no computer science degree required.

1
Connect GitHub
Me pick repo.
Give read-only access to the one repository you want checked. You can remove it from GitHub any time.
2
We read the code
Me wait. Me little nervous.
An automated review looks at security, reliability, architecture and maintainability. It reads your code; it never runs it.
3
Get your fix list
Me know what fix first.
Plain-English findings, sorted by what to fix first, each with instructions to paste into your AI coding tool.

Sample report

Playful voice. Serious review.

Each finding gets one line from Thunk, reacting like any of us would. Everything you need to act on is written plainly.

Me code need help.

Serious issues found. Review these before launching.

Sample · made-up app

2 fix first1 fix soon1 can wait14 checks clean

notes-app · main branchabout 18,000 lines readreview took 9 minutes

Fix firstA secret database key is in code that runs in the browserlib/supabase.ts, line 4

Secret key not supposed to be public. Me know now.

What we saw: Your Supabase service-role key is imported in lib/supabase.ts, which is bundled into pages people load in their browser.
Why it matters: Anyone who opens your site can copy it and read or change every row in your database, skipping all your access rules.

Take this back to your AI tool

Move the Supabase service-role key out of lib/supabase.ts into a server-only environment variable. Use the public anon key in browser code. Then make a new service-role key in the Supabase dashboard and delete the old one.

Fix firstAny signed-in user can read everyone's notessupabase/migrations/0002_notes.sql, line 12

AI say rule fine. Rule say yes to everybody.

What we saw: The access rule on the notes table is using (true), which lets every signed-in account read every row.
Why it matters: One user could see another user's private notes just by asking the database directly.

Take this back to your AI tool

Change the select policy on the notes table so a user can only read rows where user_id equals auth.uid(). Add the same check to the update and delete policies.

Fix soonCheckout trusts the price the browser sendsapp/api/checkout/route.ts, line 18

Customer pick own price. Generous app.

What we saw: The checkout route reads amount from the request body and passes it straight to Stripe.
Why it matters: Someone could edit the request and pay one cent for anything.

Take this back to your AI tool

In app/api/checkout/route.ts, look up the price on the server from the product ID instead of reading amount from the request body.

Can waitError pages show raw database messages to visitorsapp/notes/[id]/page.tsx, line 31

Error message talk too much.

What we saw: When a note fails to load, the page prints the database error, including table and column names.
Why it matters: It's not dangerous on its own, but it gives anyone poking around a map of your database.

Take this back to your AI tool

In app/notes/[id]/page.tsx, show a friendly "This note couldn't load" message and log the real error on the server instead.

Every report lists what was checked and what wasn't, so a clean result never claims more than it should.

Flint very helpful. Flint very sure.

Thunk discover Flint. Flint make fire. Fire make everything possible. Flint is the AI that built your app, and Flint is wonderful. Flint also needs someone to check his work.

All tests pass! Me deleted the tests!

Me check.

100% secure! Me checked! (Me not checked.)

Me check anyway.

Great idea! Me put password in code so you not forget!

Awk.

What we check

The stuff AI forgets to mention.

We look for

Secret keys in the openAPI keys and passwords in your code, its history, or files that reach the browser.
Who can see whose dataDatabase rules that let one user read or change another user's data.
Sign-in and accountsPages and routes that should need a signed-in user but don't.
PaymentsPrices and amounts decided in the browser instead of on your server.
How the code holds togetherThe same logic copied into several places, tangled files, and code nothing uses anymore.
Things that break quietlyMissing error handling, unchecked input, and risky or outdated packages.

We don't

Run your appWe read code only. We don't click through or test the live site.
Promise you're secureA clean report means our checks found nothing, not that nothing is there.
Change your codeWe never write to your repository. You decide what to fix.
Keep your codeCode is read for the review, then deleted. Only findings are kept.

What happens next

Thunk learn. Thunk code better.

Each fix teaches you a little more about what's in your app.

Before
AI say code fine. Me suspicious.
Discovery
Secret key not supposed to be public. Me know now.
Action
Me take fix instructions back to AI.
Progress
Me understand more. Me check again.

Questions

Good questions.

Do I need to know how to code?

No. Every finding explains the problem in plain English and gives you instructions to paste into the AI tool you built the app with. You'll learn as you go.

Does anyone read my code?

No person reads it. The review is fully automated. Your code is read only to run the review, then deleted. We keep the findings so you can see your report.

Does a clean report mean my app is secure?

No, and we'll never say it does. A clean report means the checks we ran didn't find problems. We review code only, not the running app, and every report lists what wasn't checked.

Does this replace a security expert?

No. It's an independent second look at code your AI wrote, built for apps that aren't ready for a professional audit yet. If you have business customers or handle sensitive data, a human review is still worth paying for.

Will the fixes work automatically?

Not always. The instructions are clear starting points for your AI tool, but check the result and run another review to see what got fixed.

What does it cost?

Your first review is free. After that, each review has a flat price, shown before anything runs.