Give the tool a finding.
A useful fix prompt names the route or policy, the expected authorization rule, and the redacted evidence that showed the failure. It should also ask for a test that distinguishes A from B.
Copy the audit’s prompt into Lovable, Bolt, Cursor or Claude Code. Review the proposed change before applying it. An explanation is not a repair until the application actually changes.
Repeat the relevant checks.
Deploy the change to your controlled environment, refresh the source or SQL export, and run another audit with the same scoped test objects.
Compare coverage as well as findings. A report with fewer findings because a check could not run is not evidence that a previous problem is fixed.
Keep the record current.
Builder can re-scan a verified target daily or weekly and alert you by email or Slack when the score drops or a new finding appears. Each schedule records your consent, and it pauses when ownership proof lapses or the scope changes.
Domain verification expires after 30 days and must be renewed before another URL scan. Reconnect inputs when their authorization or scope changes, and keep dedicated test accounts separate from real customer accounts.
Put it to the test.
Run an audit on an app you are authorized to test.