Method
What we don't check
ChikuOS audits are passive, outside-in checks of sites you own. They don't include penetration testing, load testing, signed-in testing across user accounts, writes to your database, a line-by-line code review, native mobile apps, your cloud or email accounts, or compliance certification, and a clean report isn't a guarantee. Here's each limit, and what to use instead if you need it. How the checks we do run work is on how we test.
Not included
- Penetration testing. We don't try to break in: no exploitation, fuzzing, brute-forcing logins or automated attack scanners. If you need a penetration test, hire a firm that does them and agree scope in writing.
- Load or stress testing. We don't send high volumes of traffic, so we can't tell you how your app behaves under heavy load.
- Signed-in, cross-user access. The AI Site Audit checks what a signed-out visitor can reach. It doesn't sign in as two users to see whether one can read the other's data. The Supabase Data-Leak Check reviews your RLS policies for that, from the policies you export or read-only access.
- Writes. We don't insert, update or delete data to prove a table is writable. Write exposure is judged from your policies and grants, not by changing your data.
- Your full source code. The AI Site Audit is outside-in and doesn't read your repository line by line. Audit + Fixes works in your repo to make fixes, but it isn't a full code review.
- Business logic. Things like discount abuse, free-trial abuse, or payments that can be skipped depend on how your app is meant to work. We flag what we notice, but we don't test business logic systematically. Our Stripe hardening offer covers payment flows specifically.
- Mobile and desktop apps. We check websites and web apps. Native iOS, Android or desktop apps, and APIs your website doesn't use, are out of scope.
- Infrastructure and accounts. Cloud accounts, DNS registrar and email account security, CI/CD secrets and team access aren't checked.
- Third-party platforms. We don't assess the security of Lovable, Supabase, Vercel, Cloudflare, Stripe or other providers themselves, only how your app uses them.
- Compliance and legal. We don't certify GDPR, SOC 2, ISO 27001, PCI DSS or HIPAA compliance, and nothing we send is legal advice.
- Guarantees. A clean report means we didn't find a problem with these checks, not that none exists. We don't promise rankings, traffic or AI citations.
- Sites you don't own. We only check sites and apps you own or are authorised to have reviewed.
Not sure if we're the right fit?
Our buyer guides compare free tools and other providers, including ones that do more than we do. Or email hello@chikuos.com with your URL and what you're worried about, and we'll tell you honestly whether an audit will help.