Understand what your AI built.

Catch the leaks, silent failures and exposed keys before your users do. Four-minute scenarios from real apps built with Lovable, Cursor and Claude Code.

Try Invoice 105, free 4 minutes · no sign-up

Try it here. You are Maya, and this is your invoice.

Invoice
#104
Billed to
Maya Okafor
For
Brand workshop, two days
Date
3 Oct 2026
Total
£1,800.00
A yellow trail blaze painted on cracked pine bark

Three marked trails

Who may see what

Sign-in, permissions, and the leaks AI-built apps ship most often.

10 scenarios. The first, “Invoice 105”, is free.

How a scenario works

Invoice 105

Your invoicing app is live. A customer emails: they changed a number in the address bar and saw someone else's invoice.

First the situation lands.

Invoice 105

  • Show invoice 105. She is signed in.
  • Refuse with 404 or 403, because Maya does not own it.
  • Hide the link to invoice 105 so she cannot click it.

Then you make the call.

Invoice 105

  • Show invoice 105. She is signed in.
  • Refuse with 404 or 403, because Maya does not own it.
  • Hide the link to invoice 105 so she cannot click it.

Right. The server checks ownership on every request. 404 is often preferred: it does not even confirm invoice 105 exists.

Then you see why.

Invoice 105

  • Show invoice 105. She is signed in.
  • Refuse with 404 or 403, because Maya does not own it.
  • Hide the link to invoice 105 so she cannot click it.

Right. The server checks ownership on every request. 404 is often preferred: it does not even confirm invoice 105 exists.

Ask your AI: “List every route that loads a record by id and show me its owner check.”

Last, check your own app.

Every scenario so far

Each one is a real failure from an app built with AI. You make the calls; we show you what the server, the database and the browser really did.

What you will learn to spot

An id that is not yoursWho may open this record?
A server that brokeReading status codes.
A table left openRow Level Security.
A secret made publicKeys in the browser bundle.
An event delivered twiceWebhooks and retries.
Two taps, two chargesIdempotency keys.
A fix that removed a checkReading what your AI changed.

One price, every trail

The first scenario on every trail is free, with no account needed. Founding members get every scenario, the skill profile, and each new trail as it ships, at this price for as long as they stay.

$49a year

A square yellow trail marker screwed to a tree trunk
  • Every scenario on every trail
  • Your skill profile across eight areas
  • New trails as they ship: databases, deploys, costs
  • Cancel any time from your account

Want us to look at your app instead? Reserve an app check, $49 once.

Questions people ask

Coding

No. You need to have built, or be building, something with an AI tool. Scenarios show small pieces of real code and logs, and explain them in plain words. The goal is to understand and judge what your AI writes, not to write it yourself.

Tools

Format

Pro

Billing

Teams

A yellow trail blaze painted on cracked pine bark

Walk the first trail

Invoice 105 takes four minutes. You will know what an IDOR is, why your AI keeps writing one, and the one prompt that finds them in your own app.

Free · 4 minutes · no sign-up

Try Invoice 105, free