Code Audit & App Rescue in Singapore

Usually fix. The data model and the user flows are normally the parts worth keeping, and they are the parts that took you longest to get right. The common defects (row-level security switched off, keys sitting in the browser bundle, no server-side validation, unverified payment webhooks, no migrations) are all repairable without starting again. Rebuild when one of three things is true: the data model cannot carry the features you need next, the code is tangled enough that no change is safe to make, or the platform will not give you your source code. That last one is decisive and worth checking first. If we look at your app and conclude you should rebuild, we will say so. It is a cheaper conversation for both of us than a rescue that was never going to work.

No. Under Singapore's Cybersecurity Act, penetration testing and managed SOC monitoring are licensable services, and the requirement applies to companies, freelancers and sole proprietorships alike. GDI is not licensed for either, so we do not offer them and we do not demonstrate exploits to prove a finding. What we do instead is source-code review, configuration and access-control review, and non-intrusive vulnerability assessment. None of those are licensable, because they do not compromise your defences. We describe each finding by file, line and configuration rather than by breaking in. If your enterprise client's security questionnaire specifically demands a penetration test, tell us early and we will point you to the CSA register of licensed providers; our code review is the complementary piece, not a substitute for it. Be wary of any Singapore supplier who offers you a penetration test without holding the licence.

On Supabase and similar platforms, open your table editor and check whether Row Level Security is enabled on every table that holds user data, and whether each one has a policy that actually restricts rows to their owner. RLS switched off means anyone holding your anon key — which is published in your browser bundle by design and is trivially readable — can read the whole table. RLS switched on with a permissive policy is almost as bad and is the more common failure, because the dashboard shows it as protected. Then search your deployed frontend bundle for anything named service_role, secret or private key: a service-role key shipped to the browser bypasses every policy you have written. These are the two checks worth doing yourself today, before you hire anyone.

Recover access before you worry about the code. Establish who the registrant is on your domain, who owns the GitHub or GitLab organisation, whose account the hosting and database sit under, and who controls the payment gateway, the app store listings and the email records. In practice this is the step that decides whether you have a business, because a codebase you cannot deploy is worth very little. Domain registrars and hosting providers have documented account-recovery routes for a verified business owner, so start there and put the request in writing. Change nothing in production until you have a current backup you have tested. Only once access is settled is it worth assessing code quality.

In the Singapore market, a bounded review of a small-to-medium codebase typically runs in the low thousands, and larger architecture reviews with remediation planning run higher. For context, senior contract engineering in Singapore sits around S$1,200 to S$1,600 a day. The fix is almost always the larger number, and a serious supplier will tell you the range for that before you commit to the review. We give a fixed quote after a free scoping call rather than publish a rate, because a 2,000-file inherited codebase and a three-week-old Lovable app are not the same job. What we will not do is quote a review without a scope: an unbounded audit is how these engagements turn into open-ended consulting. Ours is bounded in writing to a stated codebase, a fixed window, and the findings that matter ranked by severity — explicitly not an exhaustive list of every defect.

Not for the review, and we prefer not to have it. We work from the repository, a schema dump and redacted configuration, with real personal data excluded or replaced with synthetic records. That is enough to find the failures that matter, and it keeps your customers' data out of a third party's hands entirely. If a later remediation phase genuinely needs access to a live system, it happens under a signed data-processing agreement, on named accounts you create and time-box rather than a shared admin login, with the work done against a copy and no production changes outside an agreed window. Access is revoked in writing when the engagement closes. If a supplier asks for your production credentials before they have scoped anything, that is a reason to stop.

Potentially, yes. Singapore's PDPA Protection Obligation requires reasonable security arrangements over personal data in your control, and the failures the PDPC repeatedly cites in its published decisions — weak access controls, unpatched systems, poor oversight of whoever built the system for you — are the same defects that turn up in AI-generated and hastily inherited code. Responsibility stays with you as the organisation even when an outside developer wrote it, which is the part founders are most often surprised by. There are also notification duties once a breach meets the significant-harm or scale thresholds. We can map what personal data your app holds, where it flows and where it is exposed, and fix the technical side. That is an engineering assessment, not legal advice, and it is not a PDPA certification. If you need a formal legal position, speak to a lawyer or a qualified DPO.

Not for the review, realistically. PSG funds pre-approved solutions from the GoBusiness catalogue and explicitly excludes custom-built software, so a code review does not fit it. EDG covers custom projects and may fit a substantial remediation or rebuild where it delivers real capability, subject to Enterprise Singapore's criteria including Singapore registration and at least 30% local shareholding — but approval takes weeks, which is longer than most people can wait when their app is already broken. Note also that EDG and PSG are consolidating into the EDGE framework in H2 2026. Our honest advice is to budget this as direct spend and treat any grant as a bonus on the larger build, not as part of the plan. We will tell you plainly which parts of a scope are plausibly claimable and which are not.