AI App Builder Audits · AI Development Series

You built it with AI. We check what is underneath.

Lovable, Replit, Emergent, UI Bakery and the rest will get you something that works. Before real customers and real data go through it, it is worth having someone read the code properly.

Rob Sherwood, co-founder of Dev Partners
Being straight with you: we are not specialists in any of these products and we do not build with them. We build with Claude Code and Cursor, with senior developers designing and reviewing every change. What we audit is the code these tools produce — which is ordinary React, Python, Node and SQL, and that we do know.

We do not audit the tool. We audit what it produces.

There is a version of this page where we claim to be experts in twenty different AI app builders. It would not be true, and you would find out eventually. Here is the actual position.

None of these tools invent new technology

Whatever the marketing says, these platforms assemble the same components everyone else uses. Lovable hands you a React and TypeScript application on a PostgreSQL database. Emergent hands you React with a Python API and MongoDB behind it. Replit picks a stack per project and gives you Node or Python with Postgres. Underneath the branding it is all conventional technology.

That is the whole basis of this service. We have been building and repairing software on exactly those foundations since 2008. Reading a database schema and telling you it will not survive contact with your business is the same skill regardless of what typed it.

The problem is never the code you can see

These tools are good at producing something that works when you try it. What they cannot do is know things nobody told them: which users must never see each other's records, which figures have to reconcile at year end, what happens when two people press save at the same moment, which of your rules is a preference and which is a legal obligation.

So the application looks right, behaves right when you test it, and contains assumptions that were never checked against your business. Those assumptions are what an audit surfaces.

You have not done anything wrong

Nobody who brings us an AI-built application has made a mistake by building it. They had an idea, they got it working, and it did its job — which is considerably more than most people manage. Using these tools to find out whether something is worth building is a sensible use of them.

The moment to get it checked is when it stops being an experiment: when it holds other people's data, takes money, or the business would notice if it stopped. That transition usually happens without anyone deciding it has.

What we look for, tool by tool

Each platform produces a different stack, so each one fails in its own characteristic way. These pages set out what we consistently find in applications built with each.

Full-stack app generators

These hand you real, exportable code. The audit is ordinary engineering review — and entirely possible, because nothing is hidden.

Full-stack app generator Lovable Produces React and TypeScript on Supabase Generated apps live or die on their Supabase row level security policies. That is the first thing we look at. What we find in Lovable builds Full-stack app generator Emergent Produces React with a FastAPI backend on MongoDB MongoDB enforces nothing about your data. What the generated model assumes and what the database guarantees are two different things. What we find in Emergent builds Full-stack app generator and host Replit Produces React, Next.js, Express, Flask or Django with Postgres You own the code, but the application is often wired into Replit's runtime in ways that make moving it a project in itself. What we find in Replit builds Browser-based full-stack builder Bolt Produces React, Vue, Svelte or Astro, often with Supabase More framework freedom than most, which means less predictability about what you have actually ended up with. What we find in Bolt builds UI and app generator (Vercel) v0 Produces Next.js and React with Tailwind and shadcn/ui Started as a UI generator and grew a backend. Server Actions are public endpoints, and they are where the gaps tend to be. What we find in v0 builds All-in-one app generator Base44 Produces A generated React front end on Base44's managed backend Removes every infrastructure decision, which also means you did not make any of them. We check what was decided for you. What we find in Base44 builds Agentic cloud development environment (Google) Firebase Studio Produces Real code on Firebase, with Firestore and Cloud Functions Firestore Security Rules are the whole access-control model, and Firestore bills you per document read. Both are worth checking. What we find in Firebase Studio builds Full-stack app generator Databutton Produces A React front end with a Python FastAPI backend A real Python backend, which is a better shape than most. Protection is applied one endpoint at a time. What we find in Databutton builds

Mobile app builders

Mobile changes the threat model: your app ships to the user's device, where anyone can pull it apart and read what is inside.

No-code platforms

The application lives on the platform. There is usually no code to export, so the audit looks at the data model, the permission rules and your exit path.

Internal tool builders

These sit on a database you already own. The exposure is the query layer, the permission model and what the tool is allowed to do to live data.

Backends and data platforms

The layer underneath everything else. If the API or the data model is wrong here, no amount of front-end work fixes it.

Used something else?

Momen, WeWeb, Backendless, Caspio, Knack, Superblocks, Create.xyz, Tempo — new tools appear faster than anyone can write pages about them, and we are not going to pretend otherwise. It genuinely does not matter much which one you used. What matters is what your application is made of, and we can work that out from the code, the configuration or the database. Tell us what you built it with and we will confirm whether we can help before you commit to anything.

Whatever built it, we check the same four things

The tool determines where the problems tend to hide. It does not change what needs checking.

🔒

Security and access control

Whether your users can reach each other's data.

🗃

Database structure

Whether the data model fits your business or just the screens.

📈

Whether it will scale

What happens at a thousand users rather than ten.

🧩

Whether it can be maintained

Whether anyone can safely change it in a year.

AI Code Audit — £495, fixed price

Written report within five working days, credited back in full if you go on to have us fix or rebuild the application. The audit page has the full detail: what is in the report, what we need from you, and how to get started.

Meet the team

Prefer to watch? The short version of who we are and how we work

Questions about AI app audits

No, and we would rather be straight about that. We build software with Claude Code and Cursor, with senior developers designing the system and reviewing every change. What makes us useful is that these tools produce ordinary technology underneath: React, TypeScript, Python, Node, PostgreSQL, MongoDB. We audit the output, not the tool, and the output is what we have been building and fixing for years.

Yes. New AI app builders appear constantly and we are not going to pretend to have a page for all of them. What matters is what your application is made of rather than which product generated it. If you can give us the code, or access to the platform's configuration and database, we can audit it. Tell us what you used and we will confirm before you commit to anything.

£495, fixed. You get a written report within five working days of us having access to the code, covering security and access control, database structure, whether the application will scale, and whether it can be maintained. If you go on to have us fix or rebuild the application, the £495 comes off the cost in full.

Usually not, and we have no incentive to. Plenty of AI-generated applications have a reasonable foundation and a handful of specific problems, and fixing those is cheaper than rebuilding. Where we do recommend starting again it is normally because the database design cannot support what the business actually needs, and we will show you why rather than asking you to take it on trust. The report says what we found, including the parts that are fine.

Related reading

What our clients say

20 clients. A few of their words.

Working with Dev Partners to redesign and modernise our WMS system: the whole process has been thoroughly professional from the outset and a delight to work with. Cannot recommend enough.

Great agency. Have used Dev Partners for several years and they have built 20+ sites for us, in addition to taking on our legacy websites, upgrading and maintaining. Easy to work with and some great practical ideas to improve our digital offerings.

Jones Hire have been working with Dev Partners on several projects, which have been very successful. They linked our catering database to a new improved website so clients can easily place and update orders, created a custom warehouse picking app to fulfil all our challenging requirements, and are currently developing a custom transport app to streamline our loading and delivery process.

We have been trying to reinvent our website for over 5 years, trying to make it convert and failing each time. Spoke to Rob at Dev Partners, the team helped create our new site and the improvement was instant.

We have been working with Rob and the team for about 10 years now. Dev Partners helped us build a completely bespoke CRM from scratch which manages our daily business and is always well maintained. We have been able to use the system and roll it out in our new franchise branches.

We collaborated with Dev Partners on the front end of a fairly complex telemarketing platform. Rob and Jason took the time to properly understand the moving parts, asked the right questions, and delivered a clean, intuitive interface that's made the system far easier for our team to use.

I have been working with the team at Dev Partners for the last 3 years and we have always been impressed with the speed in which they act on things for us, along with the honest open communication. The team are a valuable and vital part of our supply chain.

We've had a program for our business in the electronic security sector that Dev Partners developed and keep up to date. They've never let us down, always there when needed. Thanks Rob and the team.

Dev Partners have been working with us for just over 2 years. They have significantly upgraded and redesigned our existing web platforms, and always deliver a first class service.

Dev Partners helped us build an event website. The team were very knowledgeable, easy to work with and quick to deliver a high quality product.

Working with Dev Partners has been an exceptional experience. Their team is highly skilled, professional, and committed to delivering results. What truly sets them apart is their communication and transparency; we always felt informed, supported, and confident.

We've worked with Dev Partners a few times to support us on bespoke web build tasks. They're very easy to work with, approachable, and explain the detail in a way that's understandable. A great partner for technical issues at sensible prices.

Excellent customer service backed up with solid experience. As a media business we have had five websites built by Dev Partners. I would certainly recommend them.

Found Dev Partners and they were great, nothing too much trouble. They managed to help us with integrating our old existing system with Shopify.

I've worked with Rob and his team off and on for many years and have always found them to be professional, knowledgeable, and best of all, they listen to their clients and deliver what is required.

We have worked with Dev Partners for 7 years and can highly recommend them for their expertise and excellent customer service.

Find out what you are sitting on

The AI Code Audit is £495, fixed.

Tell us which tool you built with, roughly what the application does, and how many people use it. If an audit is not the right thing for you, we will say so rather than selling you one.

What the report covers:

  • Security and access control
  • Database structure and whether it fits the business
  • Whether it will hold up as usage grows
  • Whether it can be maintained and changed safely

We reply within one working day.

Book the audit