Technical review of AI-built applications

The review focuses on the resulting source code and runtime architecture, rather than the AI tool used to create them. This includes applications built with tools such as Cursor, Bolt, Lovable and v0, as well as code generated through direct prompting of large language models.

For applications that combine no-code platforms and custom code, we agree the review scope based on the code and configuration available for assessment.

No. The review is most effective when your core features are working, but we can also assess a minimum viable product (MVP) that is still being developed.

An earlier review can help identify security issues and architectural limitations before they become more difficult or costly to address. The findings will reflect the application’s state and the agreed scope at the time of the review.

We need read-only access to your code repository, such as GitHub, GitLab or Bitbucket, or an exported copy of your codebase.

An optional 15-minute briefing or short written summary can help us understand your intended users, third-party services and target hosting environment. Please remove any live credentials or customer data before sharing code or configuration files.

No. The review uses your source code and relevant architectural configuration. We do not need production databases, live customer records or live credentials.

Where test data or a running environment is needed within the agreed scope, mock data or a staging environment is sufficient.

A mutual non-disclosure agreement (NDA) is signed before you share access to your code. Our engineers carry out the review in isolated, secure environments in the Nordic region.

All local copies of your code, temporary data and staging environments created for the review are permanently deleted once the final report has been delivered and accepted.

You retain ownership of your application and source code. The findings, roadmaps and documentation produced for you during the review are yours.

Knowit does not claim ownership of your application or its underlying logic.

Your remediation plan sets out prioritized fixes for the issues identified in the review, with time and cost estimates. It helps you understand what needs to be addressed before launch.

Your product development roadmap looks further ahead, covering improvements to architecture, maintainability, scalability and ongoing operation. Together, they help you plan both the immediate work and the longer-term development of your application.

In your report, we map identified security issues to relevant OWASP categories and use CVSS severity ratings to describe their technical severity. OWASP helps identify the type of security weakness, while CVSS helps assess how serious it is. We explain the findings in the context of your application so your team can prioritize the fixes.

Where applicable, our engineers verify whether an identified weakness can be exploited within the agreed review scope. Your report includes supporting evidence that explains the issue and helps developers address it. This does not require access to live customer data or production databases.