Probe: The demo is not the security review.

We built Probe because AI coding tools have made it much easier to get to a working product, but they have not made the deployed app review itself. The recurring pattern is simple: the app loads, Stripe works, Supabase works, the AI feature answers, and the demo feels done. Then the public surface still has exposed keys, loose CORS, public routes, unsigned webhooks, missing headers, or LLM endpoints without obvious controls. Probe is not trying to replace a full security audit. It is the boring second look for founders and small teams who used Cursor, Claude Code, Bolt, Lovable, Replit, Supabase, Stripe, and LLM APIs to move fast. If your app touches auth, payments, files, user data, or paid AI calls, "it works" is not the finish line.