before you launch
Before you take payments on an AI-built app
Check five things yourself first: that your payment provider is in live mode, a real test purchase, a refund, how the provider's events reach your app, and the provider's own dashboard. The free Scan then reads your code for secret keys saved in it and for packages with known security problems. An Audit also reviews whether one user can reach another's data.
What you still check yourself
These happen in your payment provider and your live app. nittim can't see them.
- Live mode
- Switch your payment provider from test to live, and confirm your app uses the live keys, not the test ones.
- A real test purchase
- Buy your own product with a real card, start to finish. Watch what the buyer sees and what your app records.
- A refund
- Refund that purchase. Confirm the money goes back and your app reacts the way you expect.
- How the provider's events reach your app
- Your provider tells your app when a payment succeeds, fails or is refunded. Confirm those messages arrive and that your app acts on them.
- The provider dashboard
- Open it and look. Payments, payouts, alerts and settings are all there, and only you can see them.
What nittim reads in your code
- Committed keys
- Scan and Audit. Secrets saved in your code, such as a payment key or a database password.
- Access to other users' data
- Audit only. Places where one signed-in user could reach another user's records.
- Vulnerable dependencies
- Scan and Audit. Packages your app uses that have known security problems.
Scan, Loop, Audit and Full Audit
- Scan
- Free, with no card and no sign-in. Reads a public or connected repo for committed secrets and dependencies with known vulnerabilities. It reads the code as it stands now, not its git history, so a key that was committed and later deleted is not found.
- Loop
- A checklist your own assistant runs, where your code already is. Free to run: nittim charges nothing and receives nothing of your code. Your assistant's own usage still applies.
- Audit
- A review of the code that matters most, ending in a verdict. A GitHub or Google account gets its first Audit free. After that, $29 buys 5 Audits.
- Full Audit
- The same review across every eligible source file. Priced by the size of your repo, and you see the price first.
Audit reports are delivered later, not on the spot. See the benchmark for how the results hold up. For the wider launch checklist, read how to check an AI-built app.
What it can't tell you
nittim is advisory. It doesn't replace a penetration test or a qualified professional, and a human review is a different service. A good verdict doesn't cover:
- Every real problem in your code. A good verdict can still miss one, and an Audit reads the code that matters most, not every file.
- Whether your payment provider is in live mode.
- Whether a real purchase and a refund work end to end.
- Keys that were committed once and later deleted, because nittim reads the code as it stands now.
- A built bundle, or your provider's usage and settings.
- How your app behaves under real traffic.
Common questions
I'm not a developer and I built a SaaS with AI. What should I check before I take payments?
Check five things yourself first: that your payment provider is in live mode, a real test purchase, a refund, how the provider's events reach your app, and the provider's own dashboard. The free Scan then reads your code for secret keys saved in it and for packages with known security problems. An Audit also reviews whether one user can reach another's data.
Does nittim test my payments?
No. nittim reads your code. It doesn't test your payments, so live mode, a real purchase, a refund, your provider's events and its dashboard stay with you.
Will the free Scan find every leaked key?
No. It reads the code as it stands now, not its git history, so a key that was committed and later deleted is not found. It also doesn't read a built bundle or your provider's usage.
Is this a replacement for a penetration test?
No. nittim is advisory. It doesn't replace a penetration test or a qualified professional. A human review is a different service.
How much does it cost?
The Scan is free. A GitHub or Google account gets its first Audit free. After that, $29 buys 5 Audits.
How long does an Audit take?
Usually within 15 minutes. Worst case, 24 hours.
What happens to my code?
The Scan: Files leave your machine and are read in nittim's server memory. No model, no verdict. Kept: your report, with the line each finding points at — off by setting. The Loop: Nothing of your code is sent to nittim. Your assistant runs it where it already works. Anonymised counts only, and only if you choose. An Audit reads a digest of your source. The digest goes to Anthropic on nittim's key, kept up to 30 days. Bring your own key and it goes to your account.