AI-built booking app rescued: 10 problems fixed

Task. A small dog-walking business built its booking app with an AI builder (React and Supabase). It worked in the demo, but nobody had checked what a customer could do outside the happy path.

Review. Ten findings, four of them critical. The customer table with addresses and phone numbers was open to anyone. The secret service key sat in the browser code. The browser sent the booking price, so a walk could be booked for £0. Anyone could make themselves an admin by editing their own profile data. Walkers could be double booked, and times were stored as text, so 10:00 sorted before 9:00.

Fix. Every problem was first reproduced with a real attack on the database, then fixed and attacked again: 16 of 16 checks showed the problem before and none after, while 20 of 20 normal actions still work. The data migration stops without changing anything if it meets broken rows and names them, and past abuse, such as a £0 booking, goes on a list for the owner.

Tested on PostgreSQL 18.3 with Supabase's default roles. The business and its starting code are invented; the problems are the usual ones in generated Supabase apps, and the interface was checked by reading the code. For your app the first step is the same review of data access, security and broken flows, with a before and after report: $350, 3 days. Fixes are then quoted from the report, at a fixed price per fix.

Describe what you need in plain words. I will tell you what it takes and whether a smaller first version would serve you better. Scoping costs nothing.

Live demo: https://flowlab-dev.github.io/demo/app-rescue/