The consultancy of Jeff Kloythanomsup, Amsterdam
AI-built app security review for EU founders, startups, and small businesses
I review the app your AI coding agent wrote, from secrets and sign-in to the cloud account behind it, and rank what to fix first. From €500.
AI coding agents write working apps fast. Working isn't the same as safe. The agent builds what you asked for, and nobody asked it who should be allowed to read each record. I'm starting to see the same handful of gaps in a lot of AI-built apps.
A key sits in the repository history. An API route returns any customer's invoice to anyone signed in. A package the model invented gets installed, and the agent itself can reach production. None of it shows up in a demo, so the first job is finding it before a customer does.
I've built this way myself. At ThriveUp Care I designed, built, and ran an AI-enabled marketplace end to end: 200+ API endpoints, a mobile app, Clerk sign-in, and Stripe Connect payments on AWS. I've coded with AI agents every day for more than two years, and I'm a Claude Certified Architect.
The review covers one application and the cloud account it runs in. The €500 review gives you the ranked findings and a thirty-minute readout. The €3,500 package adds the fixes, made with your team as pull requests. It's a code and configuration review, not a penetration test, and founders can buy it as consumers too.
Reference architecture
How the pieces connect
An illustrative flow, not a diagram of a client environment.
1
Scope
Repositories, pipeline, agents, and the cloud account.
2
Secrets
Keys and tokens in the code and its history.
3
Sign-in and access
Who can read or change whose data, route by route.
4
Supply chain
Dependencies, CI, and what the agent can reach.
5
Ranked findings
Exposure, reachability, and cost to fix.
6
Fixes and readout
Pull requests with your team, and what to watch next.
What's included
Secrets, keys, and tokens found in the code and its history
I scan the repository and its full history for API keys, database URLs, and tokens, then check each hit by hand. A key deleted in a later commit still works until someone rotates it. The findings list each one by file and line, never by value, in the order to rotate them.
Sign-in and API authorisation checked route by route
Agents are good at sign-in screens and weak at ownership checks. I read every route that touches user data and ask who can call it and whose records it returns. Where it helps, I test that against a staging copy with test accounts, never against production.
Dependencies checked for known flaws and invented packages
Models recommend packages that don't exist, and attackers register those names. I check every dependency against its registry and the known-vulnerability databases, and flag the ones nobody chose on purpose.
The coding agent's own permissions and the CI pipeline
The agent that wrote the code often holds more access than any engineer: production keys, deploy rights, and a shell. I map what it can read, run, and reach, and what the pipeline does with secrets. The aim is an agent that can build but can't leak.
The cloud account the app runs in
An app is only as safe as the account behind it. I check identity, storage access, network edges, and logging on AWS, Azure, or Google Cloud, with the same ranking I use for cloud security hardening.
Findings ranked by what an attacker reaches first, with the fixes if you want them
Each finding gets a rank by exposure and cost to fix, pinned to a file and line. The €500 review stops at the ranked list and a readout. The €3,500 package adds the fixes as pull requests your team reviews and merges, plus a short list of what to watch next.
Where I've done it
Every item here comes from my CV. View CV.
ThriveUp Care, Founder & CEO, 2025 to 2026
Designed, built, and ran an AI-enabled marketplace end to end: a Next.js web application with 200+ API endpoints and an Expo / React Native mobile app, shipped from v1.0 to v1.37 across about 3,000 commits in four repositories.
ThriveUp Care, Founder & CEO, 2025 to 2026
Built RAG-based matching on Claude and OpenAI-compatible APIs, backed by PostgreSQL, Upstash Redis, Clerk auth, and Stripe Connect payments, on AWS environments provisioned in Terraform.
Anthropic, 2026
Claude Certified Architect, Professional.
Senior Cloud Engineer, AWS consulting partner, 2021 to 2026
Hardened disaster recovery and data security for a Fortune 500 client by automating replication, versioning, and access hardening across 400+ S3 buckets in Python.
Tools I reach for
Claude Code, Gitleaks, Semgrep, OSV-Scanner, GitHub secret scanning and Dependabot, OWASP ASVS, OWASP Top 10 for LLM applications, Prowler, Terraform.
Guides on this
Setting up an AI-assisted development workflow
How I set up Claude Code, Codex, and similar agents for a team: instruction files, prompts, retrieval, shared memory, and multi-agent code review.
Securing AI-generated applications in the public cloud
What changes when an agent writes the code: the new attack paths, the controls that close them on AWS, Azure, and Google Cloud, and the EU reporting clock.
Other services
Cloud migration
I move teams onto AWS, Azure, or Google Cloud, or out of a setup they've outgrown. I map every dependency before anything moves.
Read morePlatform engineering
I make the cloud you already run calmer, cheaper, and understood by more than one person on the team.
Read moreCloud security hardening
I find the gaps in your cloud accounts, identity, network, and data, rank them by what an attacker reaches first, and close them with your team.
Read moreAI integration
I put language models to work on the problems that matter in your product and back office, and I ship them to production.
Read moreFractional cloud leadership
A senior cloud lead on a fixed monthly retainer, long before a full-time cloud team makes sense.
Read moreCommon questions
- What does an AI-built app security review cover?
- One application and the cloud account it runs in. I check the code and its history for secrets, every API route for who can read or change whose data, the dependencies, the CI pipeline, and what the coding agent itself can reach. The findings come back ranked by what an attacker reaches first.
- How much does it cost?
- The review is €500, and the review with remediation is €3,500. If you book the remediation within 30 days of the review, the €500 comes off its price. Businesses pay these prices plus BTW, and consumers pay the same amounts with any BTW included.
- Which tools does it work with?
- Any of them: Lovable, Cursor, Claude Code, Replit, Bolt, v0, or a mix. I review what the tool produced, not the tool, so the stack matters more than the brand. Next.js, React, Node.js, Python, and Supabase or PostgreSQL back ends are the common cases.
- Is this a penetration test?
- No. A penetration test attacks a running application from the outside. This review reads the code and the configuration, and checks API authorisation only against a staging copy. If you need a penetration test afterwards, I'll help you scope it and read the report.
- Can I buy it as an individual founder?
- Yes. It's the one package consumers can buy, so a founder without a company yet is welcome. You get a 14-day right of withdrawal, set out in section 14 of the terms. Is your app live yet, or still in staging?
Let's talk.
A 30-minute call, no pitch. We look at your current setup, your stage, and the thing that's bothering you about it. I give a straight opinion on what to change, what to leave alone, and whether the problem is the one it looks like. What's the one thing in your stack you'd fix tomorrow?
Prefer email or phone? hello@netninjas.eu or +31 6 45984313