Six review rounds for one small app

Description and use

Six independent reviews uncovered and fixed all major defects, improving test coverage and ensuring security and privacy compliance.

Problem

The app contained numerous code defects and privacy risks that were not detected by the original developer.

Outcome

Six independent review rounds uncovered and resolved all major defects, improving test coverage and ensuring the app’s security and privacy compliance.

Workflow

• 1. Build app with AI agents and add security policy.
• 2. Run first AI reviewer with read‑only access to code and live site.
• 3. Fix issues found in round 1 and run automated tests.
• 4. Run second reviewer round; fix logout cookie mismatch.
• 5. Run third round; remove deleted customer data from imports.
• 6. Run fourth round; correct time zone display.
• 7. Run fifth round; enable webhook signature verification and test with unsigned request.
• 8. Run sixth round; perform acceptance test on fake data with 61 scenarios.
• 9. Observe that each reviewer’s findings are independent of the developer’s fixes.

Evidence

The first review came back with 29 problems in the code and 13 legal or privacy risks.

Source

The security policy I had added told the browser to refuse inline scripts, and SvelteKit starts every page with one, so the pages appeared but never came alive.

Source

The send button took the phone number and the message text from the form and trusted both.

Source

Between rounds I fixed what it found, and the automated tests went from 34 to 105.

Source