The job. Apps built with Lovable, Bolt and similar tools go live after a few prompts and look finished. But nobody has checked what the public link opens up: whether customer data shows without a login, whether anyone can sign up as the owner, whether files are public.
What I did. First, a view-only check from the outside: what any visitor sees without logging in, whether sign-up and file storage are open, and whether a secret key sits in the page code. I never print the values, I only count them. Then every main step on a phone screen: booking, rescheduling, late cancellation, the waitlist, reminders and the owner dashboard.
What I found. One critical issue: anyone could create the owner account and see every customer. Five more places where bookings were lost or customers were told something untrue: a freed-up slot went to someone whose visit didn't fit, one person got several reminders, the Book button needed two taps, links in messages didn't open, and screens said "sent" too early. Plus one minor error on the owner page.
The result. All 7 issues were fixed and retested the same day. Customer data stays hidden without a login, there are no secret keys in the page code and no public files.
What's not included. The one-day check doesn't cover a line-by-line review of the code and the access settings for your data. That's the full review, with its own sample.