// Code reviews for AI-built apps

Know what's under the code you ship.

It works. Is it safe? We find what's hiding under your AI-built app.

Request a free fit call See an example report

Reviewing the app…

example-app

Dashboard
Projects
Billing
Settings

Team plan

Search projects…AKAlex Kim

ProjectsNew project

NameMembersStatus

Website relaunch1ActiveDelete2

Mobile appActiveDelete

Billing revampPausedDelete

Docs siteActiveDelete

Admin panelActiveDelete

CreditsBuy credits

2,200

+1,000 · StripeOct 303
+1,000 · StripeOct 30
+200 · WelcomeOct 12

Custom domainTeam plan

app.acme.com

Save✓ Saved4

components/Sidebar.tsx

1export function Sidebar() {

2 const items = [

3 ~~"Dashboard"~~,

4 ~~"Projects"~~,

5 ~~"Billing"~~,

6 ~~"Settings"~~,

7 ];

8 return <Nav items

9 ={items} />;

10}

lib/session.ts

12const user = await verify(cookies().get(~~"sid"~~));

lib/db.ts

1// runs in every visitor's browser

2export const db = createClient(url,

3 NEXT_PUBLIC_SERVICE_KEY);

4export function listProjects() {

5 return db.from(~~"projects"~~)

6 .select();

app/actions/projects.ts

14async function

deleteProject(id) {

15 const user =

await requireUser();

16 await db.project.delete({

17 where: { id },

18 });

app/api/stripe/route.ts

25export async function POST(req) {

26 const event = await req.json();

27 if (event.type === ~~"checkout.done"~~)

28 await addCredits(event.customer,

29 1000);

app/actions/domain.ts

11async function setDomain(domain) {

12 const user = await requireUser();

13 await db.org.update(…, { domain });

14}

Fit call: Free · 30 min
Review: From $499 · fixed scope
Report: ~5 working days · small app
Your code: NDA · read-only · deleted at close

Six questions, every review

Every finding in your report answers one of them. Pick a question and watch its bug happen, then switch on the fix.

What we check

Core journeys, edge cases and state changes do what the screen says.

Example findingcomponents/SettingsForm.tsx:13

Customers lose their changes: the form says “Saved” even when the server rejected them.

Proof you can check yourself

Three checks, each with its evidence and the link that proves it.

codeneath / proof

reviewer / named-engineer
Muhammad Saeed reads your code
Muhammad SaeedFounder, senior engineer
Reviewed-by: Muhammad Saeed
Claude helps map your code. A person checks every finding before it reaches your report.
See the founder's work →
codeneath.dev / own-review
This site passes its own review
```
$ curl -I https://codeneath.devstrict-transport-security: max-age=63072000; includeSubDomains; preloadx-frame-options: DENYx-content-type-options: nosniff
```
Strict HTTPSFraming blockedMIME lock
10 security headers · no cookies · no trackers
See every header it sends →
your-code / stays-yours
Your code stays yours
- Read-only access, or a .zip
- An NDA from the start
- Your code deleted at close
Read the terms →

From first email to fixes

See every step →

1
Free fit call
30 minutes to see whether a Review fits your app. No preparation needed.
Fit call · 30 min · free
- What does the app do, and for whom?
- What worries you most?
- Is a Review the right fit?
2
The review
About 5 working days for a small app, under NDA, with read-only access.
Codeneath Review · example app
BrowserServerDatabase
- Crit db.ts:3 · admin key in the page
- Crit projects.ts:17 · any customer's project
- Crit route.ts:26 · credits, no payment
- High domain.ts:13 · paid feature, free
Day 12345
3
Walkthrough
We explain the report on a call. Fix it yourself with the prompts, or ask us to.
Walkthrough · your report, explained
Scope the delete to user.orgId; 404 when nothing matches…
✓ Fix prompt copied
- Keep the admin key on the server
- Scope project deletes to the org
- Verify Stripe's webhook signature

Underneath the code

All articles →

It works.Is it safe?

app/actions/projects.ts:17app/api/stripe/route.ts:29app/dashboard/page.tsx:226/6

X-ray code

export async function updateProjectTitle(projectId, title) {
  const session = await getSession();
  if (!session) throw new Error("Unauthorized");
  // Missing ownership check: any signed-in user
  return db.project.update({
    where: { id: projectId },
    data: { title },
  });
}

Code review and hardening · 6 min read

How We Review AI-Built Codebases: Six Questions and File-Line Evidence

cookies().get('session')where: { userId: input.userId }NEXT_PUBLIC_SERVICE_KEY2/6

X-ray code

const token = cookieStore.get("session_token")?.value;
if (!token) redirect("/login");
// never verified: signature, expiration, revocation
export async function getBillingHistory(requestedUserId) {
  return db.invoice.findMany({
    where: { userId: requestedUserId },
  });
}
NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY=…

Security and vulnerabilities · 7 min read

Authentication Traps Under the Hood of AI-Generated Web Apps

Use AI.Know what it built.

Start with a free 30-minute fit call. Your email goes straight to the engineer who reviews your code.

Request a free fit call contact@codeneath.dev

Know what's under the code you ship.

Six questions, every review

Proof you can check yourself

Muhammad Saeed reads your code

This site passes its own review

Your code stays yours

From first email to fixes

Free fit call

The review

Walkthrough

Underneath the code

How We Review AI-Built Codebases: Six Questions and File-Line Evidence

Authentication Traps Under the Hood of AI-Generated Web Apps

Use AI.Know what it built.