AI writes the code.
Who reviews the AI?
AI tools now write more code than humans can review. We are the neutral party that reviews it – and we help you build your AI processes.
No sign-up · about 1 minute · hosted in the EU
How AmicusProof works
API key in frontend code
The key sits in code every browser downloads. Strangers could access your account.
src/lib/api.ts
− const key = "sk-live-9f2…"
+ const key = process.env.API_KEY
Verified after fix
German review standard. European data.
- Made in Germany
- Hosted in the EU
- No AI training on your code
- Data-minimal, GDPR-compliant
- AP-26 catalogue based on OWASP & BSI
AI tools build what you describe. What you don't describe is often missing: protection.
Open databases
Without access rules, anyone can read your users' data – or delete it.
Keys in the frontend
An API key in browser code is a house key under the doormat: strangers pay with your account.
Unprotected admin pages
Whoever guesses the address runs your app – no password needed.
Whoever writes the code shouldn't sign it off.
AI checks itself
- Its own mistakes are easily missed
- Same thinking, same blind spots
- No evidence for customers or authorities
AmicusProof double-checks
- Independent – we built nothing
- Documented in a review report
- With Verified seal and public proof page
- On your side: findings stay with you
Six review areas under AP-26
How we reviewAccess & permissions
Who may see and change what?
Secrets & keys
Are passwords or API keys exposed?
Inputs & attacks
Can your app withstand manipulated input?
Dependencies & supply chain
Do you use packages with known holes?
Configuration & operations
Are servers and headers set up securely?
Privacy & German law
Does it fit GDPR, imprint and cookies?
The right review for your team
Team
up to 10 developers
An ongoing second check on every pull request.
Team Plus
up to 25 developers
Several repos, SBOM and monitoring.
Individual
on request
Acceptance, CRA evidence, white label.
Frequently asked questions
What does “AmicusProof Verified” mean?
Your app was reviewed under our AP-26 catalogue and received a grade from 1.0 to 5.0. The seal links to a public proof page.
Is this an official certification?
No. AmicusProof Verified is our own review standard, based on OWASP, BSI and the Cyber Resilience Act.
What happens to my code?
We use it only for the review, process it in the EU and delete it afterwards. No AI training.
Do I need to know how to code?
No. Every finding comes with a prompt you paste straight into your AI tool.
Can anyone see my findings?
No, only you. You show the seal only if you want to.
Why are you called AmicusProof?
“Amicus curiae” is the neutral friend of the court. “Proof” means evidence – and secured.