AppBully.Choose your Bully style
Same checks. Different mouth. Savage AF gets sweary.
You built it.Now make itbully-proof.
Vibe-coded an app? Nice. Put its code, database, legal basics, and design in front of the Bully. Get the receipts, grab a fix prompt, and come back swinging.
Works with
Claude Code
CodexMCP “It works on my machine.” Cute.
PICK ON BUGS.NOT BUILDERS.
Four subjects. One tough grader.
The code. The data. The fine print. The first impression. Your app has more than one kind of homework.
Code
“It runs” is a low bar.
Look for exposed secrets, risky source patterns, and supported package advisories.
- Source evidence and file locations
- Prioritized prompts for your coding agent
- Recheck after you push a fix
“That secret has a public name tag.”
Database
Your database isn’t a public playground.
Review supported database settings, access policies, and exposed data risks.
- Row-level security and policy observations
- Connection and configuration checks
- Run another check after a change
“Who gave everyone a hall pass to this table?”
Legal
Your footer isn’t a legal department.
Spot missing policy links, placeholder details, and questions to take to a lawyer.
- Privacy notices and terms of service
- Cookie disclosures and limited browser checks
- Context from your business and audience
““[Company Name]” forgot to do its homework.”
This is not legal advice. Please consult a real lawyer.
Design
Less AI slop. More you.
Spot AI-slop patterns in public pages: repetitive decoration, awkward layouts, and unclear visual priorities.
- Desktop and mobile screenshot evidence
- Repetitive labels, clutter, and competing CTAs
- Keep brand choices that are intentional
“Two main characters. Both buttons want the click.”
Examples show the kind of feedback you can get. Every report explains its coverage. No security certification, legal compliance verdict, or claim that AI wrote your design.
Less guessing. More receipts.
See what needs attention, why it matters, and exactly what to hand your coding assistant.
Findings
Interactive exampleHow cooked?
3 recommended fixes
Fix this first.
Select a finding to exploreCode findings
3 recommended fixes. Start with the first one.
A secret key may reach the browser
A secret uses a public environment variable name. Check whether it is included in the browser build.
NEXT_PUBLIC_PAYMENT_SECRETSend your agent some homework.
Code check only. Running website not tested.
Fictional findings. Real workflow. Review your agent’s changes, then recheck in AppBully.
Connect your app. We’ll take it from here.
Four kinds of homework. One place to work through it. Your agent handles the changes; you stay in control.
GitHub
Supabase
FirebaseComing soonRead-only checks. No full repository copy stored.
We save findings and supporting evidence so you can come back and fix what matters.
What gets accessed and saved?
GitHub
Selected files are processed temporarily on our servers. We do not keep a full repository copy, run your code or push changes.
We save findings so you can come back and fix them. These include file names, line numbers, commit details and short code excerpts that explain an issue. We redact recognized secret formats, but cannot guarantee every sensitive value is caught.
The standard code check does not send your repository to an AI model. If you ask for an AI explanation, that finding’s evidence and context are sent to our AI provider. Public package names and versions are sent to OSV to check for known vulnerabilities.
Supabase
What we read: Security settings, table and policy information, and security warnings from Supabase. We do not retrieve the records in your tables.
What we save: Findings and supporting details, such as table names and the settings behind a warning. We do not keep a copy of your database.
What we leave out: Configuration responses can include sensitive fields, such as email-service passwords or sign-in provider secrets. If Supabase sends these, they reach our server temporarily in memory. We keep only the security settings needed for the check and exclude other fields before saving reports. We do not rely on Supabase masking them first.
We do not log raw configuration responses or send them to an AI provider. We do not call Supabase’s secret or API-key retrieval endpoints.
We need read access to Projects, Database, Auth, Storage and REST. These permissions can allow more than our checks use. If Supabase asks for Secrets or write access, cancel and contact support.
A Database check looks at supported settings when you run it. It does not automatically clear a Code finding from an older migration.
Connection tokens are stored encrypted. When you use MCP or paste a fix prompt into your coding assistant, you share the selected findings and evidence with that assistant.
- 01
Connect your app.
Connect GitHub or Supabase for source and database checks. Add your public URL for Legal and Design reviews.
- 02
We find the gaps.
Pick a review. We bring file evidence, policy observations, or screenshots and a clear next step.
- 03
Get the fix.
Give the fix prompt to your coding agent. Once it makes the changes, we’ll check the fix.
Your agent writes the code. We bring the second opinion.
The app is more than its source code. Review the data boundaries, fine print, and first impression in the same place, with evidence your agent can work from.
Your coding assistant. Now with receipts.
AppBully spots the loose ends. Claude Code or Codex gets the evidence and fix prompts, right in your editor.
Claude CodeCodex
AppBullyFindings for your appWho can edit this record?
api/projects/[id]
Check that the person making changes owns the project.
AppBully · Finding + evidenceClaude CodeCodexFound the loose end.
Check ownership before saving a project. Keep other users from changing it.
Illustrative example. Review changes with your assistant, then recheck in AppBully.
You built it. Now what?
“My first app worked when I tested it. I just didn’t know what I might have missed. This gave me somewhere to start before I sent the link to anyone else.”
Maya P.Building my first app“I usually end up asking my agent to fix things I don’t really understand. The fix prompts helped me be more specific, and I could come back and check the changes.”
Jordan R.Working on my second app“Honestly, I’d barely read the policy pages my agent made. I was focused on getting the app working. This reminded me there was more to launching than the features.”
Sam T.Launching my first website“I kept asking my agent to make the site look better and getting another version of the same thing. Specific feedback on what to change was a lot more useful.”
Alex C.Building a weekend projectAn admin key with a public name tag. Bold. Let’s keep that one out of the browser.
Your Bully, with receiptsFair questions. Straight answers.
What can AppBully check right now?
Four areas: supported code and dependency checks through GitHub, database configuration and access checks through Supabase, legal-basics reviews of public pages, and desktop/mobile design reviews. Each report shows its evidence and coverage limits.
Why use this alongside my coding agent?
Your agent helps you build and fix things. AppBully handles the checking workflow, so you don’t have to decide which review questions to ask or keep track of every observation yourself.
Do I need to know security stuff?
No security vocabulary quiz at the door. Findings explain the issue in plain language, show the evidence, and include a fix prompt you can give your coding agent.
Can I connect GitHub, Supabase, or Firebase today?
GitHub and Supabase are available. Firebase is coming soon.
Will this spot AI-slop design?
Design reviews combine browser observations and AI screenshot feedback to flag things like repeated labels, competing buttons, and visual clutter. These are suggestions, not proof of AI authorship. Review up to three public pages, and mark deliberate brand choices as intentional.
Does Legal replace a lawyer?
No. We flag observable policy gaps, placeholder text, and review questions. We cannot establish whether your policies are accurate or legally sufficient. This is not legal advice. Please consult a real lawyer.
Does a clean result mean my app is secure?
No. It means no findings remain within those specific checks. A clean result is not a full security audit or a live attack test.
The best part? Making us shut up.
The Bully is on your side. Fix the weak spots. Bring back the receipts. Make us take the L.
Create your account Create your account. Bring your ambition.