Understand what your AI built.
Catch the leaks, silent failures and exposed keys before your users do. Four-minute scenarios from real apps built with Lovable, Cursor and Claude Code.
Try it here. You are Maya, and this is your invoice.
- Invoice
- #104
- Billed to
- Maya Okafor
- For
- Brand workshop, two days
- Date
- 3 Oct 2026
- Total
- £1,800.00

Three marked trails
Who may see what
Sign-in, permissions, and the leaks AI-built apps ship most often.
10 scenarios. The first, “Invoice 105”, is free.
How a scenario works
Invoice 105
Your invoicing app is live. A customer emails: they changed a number in the address bar and saw someone else's invoice.
First the situation lands.
Invoice 105
- Show invoice 105. She is signed in.
- Refuse with 404 or 403, because Maya does not own it.
- Hide the link to invoice 105 so she cannot click it.
Then you make the call.
Invoice 105
- Show invoice 105. She is signed in.
- Refuse with 404 or 403, because Maya does not own it.
- Hide the link to invoice 105 so she cannot click it.
Right. The server checks ownership on every request. 404 is often preferred: it does not even confirm invoice 105 exists.
Then you see why.
Invoice 105
- Show invoice 105. She is signed in.
- Refuse with 404 or 403, because Maya does not own it.
- Hide the link to invoice 105 so she cannot click it.
Right. The server checks ownership on every request. 404 is often preferred: it does not even confirm invoice 105 exists.
Ask your AI: “List every route that loads a record by id and show me its owner check.”
Last, check your own app.
Every scenario so far
Each one is a real failure from an app built with AI. You make the calls; we show you what the server, the database and the browser really did.
Who may see what
10 scenarios- Invoice 105FreeYour invoicing app is live. A customer emails: they changed a number in the address bar and saw someone else's invoice.4 minutes
- The table anyone can readProYour app uses Supabase straight from the browser. A stranger posts a screenshot of your whole users table on X.5 minutes
- The admin buttonProOnly admins see the Refund button. A regular user has just refunded their own last three orders.4 minutes
- One field, a million creditsProA free user now has 1,000,000 AI credits and the Pro plan. Stripe shows they never paid.4 minutes
The life of a click
7 scenarios- The save that saved nothingFreeA user clicks Save on their profile. A green 'Saved!' appears. When they reload, their changes are gone.4 minutes
- Works on my machineProSign-up works perfectly on your laptop. On the live site, every sign-up fails.4 minutes
- The double orderProA customer on slow hotel wifi taps Pay twice. They are charged twice and get two orders.5 minutes
- Confirm email, reach localhostProYour first real user signs up and clicks the confirmation link. Their browser says 'This site can't be reached: localhost'.4 minutes
Money and secrets
7 scenarios- The key in the bundleFreeYour OpenAI bill jumped from $40 to $3,900 overnight. Your app has 60 users.4 minutes
- The webhook that arrived twiceProA customer bought one month of credits. Their account shows two months. Your Stripe dashboard shows one payment.5 minutes
- The fix that made it worseProA customer with orders sees 'No orders yet'. You asked your AI to fix the orders page. It says: 'Fixed! Everything works now.'5 minutes
- The key you deletedProYour AI committed a file with your API key. You deleted it in the next commit and made the repo public a week later. The key is being used.4 minutes
Data you can lose
5 scenarios- The agent that reset productionFreeYou asked your coding agent to fix a failing migration. It says it 'reset the database to resolve drift'. Your live customers are gone.5 minutes
- The backup that wasn't thereProAt 4pm a bad script deletes your orders table. You open the backups page expecting to undo it.4 minutes
- Back to yesterday's versionProToday's update broke checkout, so you restore yesterday's version in your builder. Now the whole app crashes.4 minutes
- Exactly 1,000 ordersProYour admin dashboard says you have 1,000 orders. It has said exactly 1,000 for three weeks.4 minutes
Bills that explode
8 scenarios- The open summarise buttonFreeYour app has a free 'summarise this PDF' button. Your AI bill says you made 2 million requests last night. You have 60 users.4 minutes
- A quiet week, a loud billProAlmost nobody visited your site this week. Your hosting bill is forty times higher than usual.4 minutes
- 500 signups overnightProYou give every new account 50 free AI credits. You wake up to 500 new signups and no new customers.4 minutes
- The update that updates itselfProYou added a function that stamps 'updated_at' whenever a profile changes. By morning your database bill has a new digit.4 minutes
Working with your AI agent
10 scenarios- Approve this command?FreeYour coding agent wants to clean up old build files before a fresh build. It asks you to approve one command.4 minutes
- 'Fixed!' for the fourth timeProYour AI has said 'Fixed!' four times. The bug is still there, login now fails too, and you have spent the afternoon's credits.4 minutes
- 48 green testsProYou asked the AI to make the failing tests pass. All 48 tests are green. Yesterday there were 61.4 minutes
- The ticket that gave ordersProYour coding agent is connected to your database so it can triage support tickets. One ticket is not quite a question.5 minutes
Launch day
11 scenarios- Launch day, no emailsFreeYour own test signups always got their email. You launch on Product Hunt, forty people sign up, and not one receives the confirmation email.4 minutes
- Sign in with Google: Error 400Pro'Sign in with Google' works perfectly on your laptop. On your real domain, users see 'Error 400: redirect_uri_mismatch'.4 minutes
- The 504 at second 60ProGenerating a long AI report works on your laptop. In production, where the route's time limit is set to 60 seconds, big reports fail with '504 Gateway Timeout'.4 minutes
- The old priceProYou raised your price an hour ago. Your admin page shows the new price. Customers are still checking out at the old one.4 minutes
What you will learn to spot
One price, every trail
The first scenario on every trail is free, with no account needed. Founding members get every scenario, the skill profile, and each new trail as it ships, at this price for as long as they stay.
$49a year

- Every scenario on every trail
- Your skill profile across eight areas
- New trails as they ship: databases, deploys, costs
- Cancel any time from your account
Want us to look at your app instead? Reserve an app check, $49 once.

