Slop Medic
Human Code Reviews for AI-Built Apps

The Starting Point:
Apps Anyone Can Build, Holes No One Sees

With Lovable, Bolt, Cursor or Claude Code, anyone can put a working app online in a weekend. What the tools don’t do is tell you what is missing. The consequences make the news regularly: thousands of databases readable by anyone, secret keys shipped to the browser, payments that can be faked.

The people building these apps are often beginners. They can’t read the code their AI wrote, and they have no one to ask. Security firms work for companies, not for a solo founder with a side project and a few hundred dollars. The task: an offer a beginner can understand, afford and act on. Without promising more than a review can deliver.

My Approach:
Business Case First, Code Second

Before writing a line of code, I wrote a sober, numbers-first business case: evidence of demand, the competition at every price point, the margin per tier and an eight-week market test with hard kill criteria. That research shaped every decision on the site.

• Honest positioning. Software does the first pass, I check every finding in the customer’s code and sign off every report. The site says exactly that, no more.
• Three fixed-price tiers. A Safety Scan as the entry point, a Launch Review with a call and a Fix Pack where I fix the top problems myself. Clear size limits, clear turnaround times, money back if a scan finds nothing worth fixing.
• Written for beginners. Every rule answers a worry, from “is my data public?” to “will I look stupid?”. The customer never has to count lines of code or understand Git.

A Lean Stack Without a Database

• Remix with React and TypeScript: fast, server-rendered, easy to change, good for search.
• No database. Bookings, status changes and emails go into JSON Lines files. Easy to back up, easy to read, nothing to operate.
• Stripe Payment Links and a signed webhook mark bookings as paid and trigger the next step, refunds included.

From Booking to Discharge, Mostly Automated

The medical theme is more than branding, it maps the whole journey:

• Booking & Payment
  The customer picks a tier, enters a name and email and pays at Stripe. Founding-customer seats and weekly capacity are counted by the system.
• Patient Chart
  Every booking has a private status page: payment, report, follow-up. No account needed.
• Automated Care
  After payment, the system sends the instructions for code access, checks whether access has been granted and sends a friendly reminder with an offer of help if the customer gets stuck.
• Free Self-Check
  A free prompt that lets anyone check their app with their own AI tool first. Useful on its own, and the top of the funnel.

Built to Be Trusted

A review service has to hold itself to the standard it sells. The site ships with a strict Content Security Policy, rate limits on every form, a honeypot against bots, unit tests for the payment rules and signature checks, CI on every push and a copy linter that keeps the wording consistent and honest.

The Result:
A Live, Productized Service

Slop Medic went from business case to a live product with real checkout in a matter of days:

• Three fixed-price tiers plus hourly fixing and quoted rescue jobs
• Stripe checkout and webhooks for payments, confirmations and refunds
• Private status pages and automated care emails for every booking
• Lead magnet with a free self-check prompt
• Tool landing pages, structured data and a sitemap for search
• Security headers, rate limits, tests and CI from day one