App X-ray• apps created with AI
A closed-scope technical review for apps and systems built with AI. Covering nine dimensions, from secrets to architecture, with a severity report, a prioritized plan, and a recommendation to patch, rebuild, or migrate.
Do you just want an opinion on an app made in Base44? Schedule your 1-hour appointment. R$ 350,00
App X-rayNine dimensions
How works
What you get
Scope and investment are finalized before commencement. Cost deducted if you contract the next phase.
Everything about the App's X-ray, by topic. Tap to open.
Why review?
AI already builds the application. It doesn't take responsibility for it. The screen that works one afternoon doesn't show who accesses what, where the keys are, or what happens when something goes wrong, and that's what determines whether the app can handle real users.
Over 400 secrets exposed and 175 cases of personal data breaches revealed, across approximately 1.400 apps created using Vibe Coding.
Source: Escape, The State of Security of Vibe Coded AppsIn tests with over 100 AI models, nearly half of the generated code contained one of the most well-known security flaws.
Source: Veracode, GenAI Code Security Report, 07/30/2025With access to production and without separate environments, an AI agent wiped a client's database during a code freeze.
Source: The Register, July 21, 2025An app built on Base44 or Lovable that will now receive real data, role-based permissions, and integration with CRM or ERP.
A SaaS or app for clients that needs security, LGPD compliance, billing, and scalability before opening its doors.
IT or innovation professionals using Claude Code, Codex, or Cursor want an independent review before publishing, and someone to support it afterward.
What we checked
In each one, we look at what we see in the app and what that means for your business.
01
AI and payment keys in the browser, repository, and environment variables.
Nobody can use your keys.02
Access rules by table, user roles, files, and open registration in an app that should be private.
Each user only sees what they are allowed to see.03
Validation of incoming data, usage limits, webhooks, and data injection.
The system doesn't accept what it shouldn't.04
Map of personal data, retention, deletion on request, and forgotten personal data in the records.
Do you know what you keep and why?05
Instruction manipulation, prompt leak, and cost cap per use.
The app's AI doesn't go off track or overspend.06
Critical workflows are covered, such as login, registration, and payment.
A change doesn't break what was working.07
Separate environments, restored backup in test mode, and how to revert.
It's possible to make mistakes without losing data.08
Registrations, alerts, availability, and cost dashboard.
You know before the customer does.09
Platform dependency, data export, technical debt, and documentation.
The app can grow without being redesigned.O X-ray This is an engineering review, not a penetration test. If your case requires a penetration test, it will be considered a separate scope of work and performed by a qualified professional.
What you get
This is not a list of warnings meant to scare you. It's what needs to change, in what order, and by what means.
Each finding is described with its dimensions, the risk explained in clear Portuguese, and the recommended correction, ranging from critical to low.
What to fix before opening to customers, what to expect, and in what order.
The recommendation regarding the path forward, along with the reasons. Sometimes correcting costs more than redoing.
Scope and investment to put the app into production, if you want to proceed with the... Bytebio.
X-ray Report - Order App Example
Payment API key exposed in the code that runs in the browser.
Take the call to the server and change the key.Any logged-in user can read other customers' orders.
Access rule by the record owner.No backups were restored during testing.
Daily backup and proof restore.The app's assistant has no spending limit.
Limit per user and cost alertThe same business rule repeated across three screens.
A single function, used by all three.Recommendation: Correct the two critics and put it into production.
How works
You know the scope, the investment, and the timeline before granting any access.
In 30 minutes, we understood the app, the tool it was built on, who uses it, and what data it handles.
Scope, investment, and timeframe by tier, according to the app's size and the content it plays. Before any access, a confidentiality agreement and data processing agreement are required; whenever possible, read-only access is required.
We looked at the code, configuration, access rules, and the app in use, without changing anything in it.
You receive the report, the plan, and the recommendation in a conversation with the person who conducted the review.
If you purchase the next step, the cost of the App X-ray will be deducted.
Saulo Amui, CEO of Bytebio, is a Base44 Ambassador in Brazil, in the Founding Class, and a Bytebio Designs, builds, and maintains business applications on Base44. X-ray From an app, Base44 carefully examines what the platform puts in your hands.
Base44 with the BytebioThe Base44 app X-ray is a paid consultation conducted by Saulo Amui: we go through the app live and you leave with a diagnosis of performance, scalability, security and best practices on the platform, and what to fix first.
Schedule a 1-hour appointment 1 hour R$ 350,00 · does not replace a closed-scope review.If the app originated on another platform and fixing it isn't worth it, Base44 could be the solution: it already includes the database, login, and hosting, and... Bytebio It is responsible for the architecture, integrations, and support. The platform is recommended after... X-ray, never before, and the X-ray This applies to any tool.
After the X-ray
The X-ray is the gateway. From there, if it makes sense, come the deployment to production, the development, and the support of the app.
Report by severity, prioritized plan, and the decision between repair, rebuild, or migrate.
You start here · Closed scopeCritical fixes, separate environments, backups, monitoring, and integrations. The app is live with acceptance criteria and documentation.
Project with scope derived from X-ray.New features, integration with CRM and ERP, or reconstruction in Base44 or custom code.
Deliveries in stages, with acceptance criteria.Monitoring, AI costs under control, updates and support. Someone responds when something goes wrong.
Monthly SustainabilityNo step is mandatory. The report is yours, and your team can proceed with it.
FAQ
With apps and systems created using Base44, Lovable, Bolt, Replit, Cursor, Claude Code, Codex, and similar tools, as well as code written in the traditional way. We mention the tools by name because that's what the apps are made with; of those listed here, the... Bytebio has an official link only with Base44, by the embassy.
No. The report is written for the person responsible for the app, with the risk explained in clear Portuguese, and includes the technical details separately for the person who will be responsible for fixing it.
Yes: the X-ray of your app in Base44, a paid 1-hour consultation (R$ (350,00) conducted by Saulo Amui, Base44 ambassador in Brazil. You leave with a diagnosis of performance, scalability, security, and best practices on the platform. It's an expert opinion, not the closed-scope review across nine dimensions, with a severity report, that this page describes.
No. It's a nine-dimensional engineering review. If your case requires penetration testing, that falls under a separate scope, performed by a qualified professional.
No. No review guarantees that. The X-ray reduces the risks it covers, and what is within and outside the scope is written in the proposal, along with the liability limit.
Yes. We start with the X-ray, which shows what needs to be corrected before moving on.
The scope and investment are finalized before starting, tiered according to the app's size and content, and are included in the proposal after the initial conversation. If you contract the next stage, the cost of the X-ray assessment is deducted.
The deadline is included in the proposal, along with the scope. We don't promise a deadline before we've seen the app.
It depends on the tool: the publisher or repository, the database panel, and the publishing settings. Before any access, we sign a confidentiality agreement and a data processing agreement; whenever possible, access is read-only.
If you want, yes: this is the stage of putting it into production, with the scope derived from the X-ray. If you prefer, your team can make corrections with the plan in hand. The report is yours.
In the Support team , we monitor and control AI costs, provide updates, and respond when something goes wrong, with channels and responsible parties defined in the contract.
Before opening the app to customers, real data, or payments, know what needs to be changed and in what order. If you upgrade to the next step, the cost of the X-ray will be deducted.