We review code, and we build software that performs.
Raxbi is a UK product and engineering studio. We review codebases for startups and SMEs, build apps and websites, and make our own tools.
Your database admin key is reachable from the browser
The Supabase service-role key is read in a file that ends up in the code sent to users' browsers. It ignores every row-level security rule, so anyone who loads that page could read or change any row, including other customers' data. Rotate the key today and move these queries to a server-only route.
- createClient(url, SERVICE_ROLE_KEY)+ createClient(url, ANON_KEY)
Illustrative example, not from a client's code
See the review01 / Services
Code health and security review
A senior review of your code, in plain English.
- Locrin, our open-source checker, reads every file in scope the same way every time.
- A senior engineer confirms each finding and reads the risky code by hand.
- A plain-English report, a walkthrough call, and a re-run after you fix.
From £395 + VAT
- Snapshot3 working days£395
- Full review7 to 10 working days£1,750
- Review plus fix supportagreed per repositoryFrom £3,000
Next Accessibility review (WCAG 2.2 AA)
Register interest02 / Products
Locrin by Raxbi
A code quality gate that gives the same verdict every time.
- Pass, advisory, or block, with no model in the loop.
- Claude Code hears about a block before it moves on.
- Free and MIT licensed. No account needed.
autoPerformance by Raxbi
AI load testing that diagnoses, not just charts.
- Describe a test in plain English.
- An AI agent designs and runs the right test.
- A senior engineer's diagnosis, not just graphs.
autoSecurity by Raxbi
AI security testing that explains itself, in plain English.
- Authorise a staging target: staging only, never production.
- An AI agent scans and triages, OWASP-aligned.
- A plain-English audit with the evidence and the fix.
autoAccessibility by Raxbi
AI accessibility testing across full WCAG 2.1 & 2.2.
- An AI agent audits your pages in a real browser.
- Every WCAG issue, mapped, prioritised, and explained.
- A plain-English report plus a guided manual checklist.
03 / Studio
Small senior team, direct communication, and a bias for shipping. We care about the details that make software feel fast and trustworthy.
App development
Native-quality iOS and Android apps, built end to end: product thinking, design, and shipping to the stores.
Get in touchWeb development
Fast, modern websites and web apps. Clean engineering, sharp design, and performance that holds up.
Get in touchFastLift
One of our own products, designed and built end to end, then shipped to both app stores. Proof of how we build for clients too.
- A fasting timer, lifting log, and protein tracker in one, built for recomposition, not a diet.
- Native-quality iOS and Android from one Expo codebase, offline-first, no sign-up to start.
- Product, design, engineering, and store submission, taken end to end by Raxbi.
- Pull requests and agent edits checked by Locrin, our open-source quality gate.
Have something that needs to perform?
Tell us what you are building. We reply like engineers, not like a sales team.