Your app was built with AI. Find out what breaks before your customers do.

• User flows, end to end. Sign-up, login, the core thing your product does, checkout or payment, password reset. I go through each one the way a careful user would, then the way a careless one would.
• API behavior on those flows. What the browser sends, what comes back, and what happens when a request is malformed, repeated, oversized, or sent without a login. Full Audit only.
• Real devices, not emulators. A real iPhone running Safari on every audit. Real Android, plus desktop Firefox and Safari, on the Full Audit.
• Page speed where it matters. Core Web Vitals on the pages your customers actually load. Full Audit only.
• Accessibility observations. Keyboard use and screen-reader behavior, reported as things to fix. Never a certification. Full Audit only.
• An exploratory pass. The part no scanner does. I try what a rushed user would try, then what a hostile one would.

What you receive

• A ranked findings report. Each finding states its severity, where it is, how to reproduce it, and what to do about it.
• A walkthrough video showing each problem happening, so your developer or your AI tool can fix it without guessing.
• A short call afterward, if you want one.

How findings are ranked

This is the report's structure. Each finding sits under one of these headings with its location, reproduction steps, and a fix note.

Critical Data can be lost or reached by the wrong person, or payment is broken.

High A core flow is broken, or wide open.

Medium Degraded function, weak checks, missing validation or rate limiting, performance cliffs.

Low Error-handling gaps, accessibility issues, dependency risks with plausible user impact.

1. Buy the audit. Card checkout through Stripe. You land on a short intake form straight after.
2. Fill in the intake. Your app's address and the flows you care about, plus anything you already suspect is broken. Test logins come by reply to my confirmation email, never through the form. The turnaround clock starts the day I have what I need.
3. Talk to me if you want to. A 15-minute intro call is there for the asking. Most people will not need it. Email gets a reply within one business day.
4. I test. You hear from me during the audit only if I am blocked.
5. You get the report and the video. Read the top findings first. They are ranked for a reason.
6. Fix it, or have the fixes directed and re-tested. See after the audit.

Hi, I'm Monika, and every StoneSteady audit is done by me. I spent a decade finding what breaks in other people's software, several of those years building automated tests in Playwright. For the past year I have worked daily inside agentic AI coding tools, so I know what they get right and which defaults they leave in place.

I hold the ISTQB Certified Tester Foundation Level certification (Australia and New Zealand Testing Board, 2019). I work from Queensland, Australia, and take clients anywhere the work can be done over the internet. Automation runs my checks; the judgment in your report is mine.

• Penetration testing. Never, at any tier. It needs qualifications and legal authorizations I do not hold, and I will not pretend otherwise. Security problems I meet during normal testing, like an endpoint that answers without a login, are reported like any other finding.
• Native mobile apps. Web apps only, including web apps used on real phones.
• Load testing. I measure speed. I do not simulate ten thousand users.
• Accessibility certification. Observations, yes. A WCAG conformance claim, no.
• Fixing your code. The audit finds and ranks the problems. Fixing them is a separate, quoted engagement. Expect the list to be longer than you would like.

Available on request, only with a signed, scoped authorization letter: a security configuration review. It is never called a penetration test.

• Fix Verification. I write developer-ready fix instructions for each finding. Your developer, or your AI tool with a human at the keyboard, makes the changes, and I re-test each one until it is verified closed. I do not change your code by default. Quoted after your audit; expected range US$1,100 to 2,500.
• Monitoring. Uptime checks, a weekly automated run through your key flows, a quarterly re-audit, and a monthly report, for products that are live and still changing. From US$290 a month.
• Managed Test Suite. A 30 to 40 test Playwright suite that lives in your repo and stays yours, run weekly and on every deploy, with a senior human reading every failure so flaky runs are filtered out before they reach you. US$1,200 a month plus a setup fee quoted after your audit.

Want any of these? Email me or book a 15-minute scoping call.

None of this argues against building with AI. It argues for checking what was built before real people depend on it. The tools are good at writing code that runs. Whether it holds up when a customer does something unexpected is a different question, and it is the one I answer.

Both sources sell security tooling; their methods are published and cited here.

1. Symbiotic Security, "We scanned 1,072 vibe-coded apps: 98% had security flaws", 2026. Passive, non-intrusive scan of live Supabase-backed apps built with Lovable, v0, Bolt, Replit, Windsurf, Tempo and FlutterFlow.
2. Veracode, 2025 GenAI Code Security Report: 100+ models, 80 coding tasks mapped to MITRE CWE.