Security Review of a Free Production-Readiness Audit

Golux Group runs a free audit at goluxgroup.com/audit that checks AI-built apps from the outside: exposed keys, tables readable without login, missing security headers. We want an experienced application security tester to try to fool it. You build a few small test apps with Lovable, Bolt or Supabase, plant known mistakes in them, run the audit, and record what it caught, what it missed and what it flagged wrongly. Test only apps you own; scanning anyone else's site is out of scope. Deliverable: a written report listing each miss and false positive, how to reproduce it and a suggested new check, ranked by how much it would hurt a real founder. Done means the report covers at least 15 planted issues and we can reproduce every item from your notes. Mandatory: web application security testing, OWASP Top 10, Supabase row-level security, HTTP security headers. Nice to have: Burp Suite, hands-on experience with Lovable or Bolt apps.