Claim verification
Does the product actually do what the landing page, docs, pricing, and UI tell users?
Product truth audits for AI-coded apps
Your app says one thing. Production may say another.
RealityDiff compares your landing-page promises, specs, code, data flows, and live product. You get evidence-backed gaps, not a generic AI code review.
$249 founding price
Within 72 hours after access
5 actionable gaps or a full refund
Read-only by default
Run by Ethan Cho. No credentials or write access are requested in the application form.
REALITYDIFF / PRODUCT-TRUTH-MAP
01
Public promise
Landing pages, docs, UI copy, pricing, policies.
02
Live behavior
Routes, flows, error paths, deployment state.
03
Business logic
State transitions, credits, limits, webhooks.
04
The diff
Reproduction, impact, source lines, smallest fix.
Not another code scanner
We look for the bugs that live between files.
Security scanners find familiar vulnerable patterns. Browser tests check flows you already knew to specify. RealityDiff looks for contradictions across the whole product, especially after rapid AI-assisted pivots.
Pivot debris
Old products, routes, jobs, tables, and CTAs that stayed live after strategy moved on.
State contracts
Event names, enums, filters, and state machines whose readers silently disagree with writers.
Economic idempotency
Payments, credits, points, and rewards that can duplicate under retries or concurrent requests.
Deployment drift
Wrong production branches, missing secrets, sandbox payments, stale environments, and ephemeral data.
Behavioral verification
Auth, mobile, empty states, failures, limits, and actions that only break in the running product.
Internal pilot
One app. One pass. Six real gaps.
We ran the first pilot on an app we built and operate. Identifying details remain withheld while the issues are remediated. These are sanitized findings, not hypotheticals.
Sample product-truth report
Live product + repository + deployment configuration
P0 CORE
“Hidden” holdout tests were public
The product’s core trust claim said holdout tests were hidden from participants. The exact holdout files and expected answers were shipped in the public repository, allowing prompts to overfit the supposedly secret cases.
promise: hidden holdouts → reality: public /specs/*/holdout.test.*
P0 MONEY
Paid-credit fulfillment was not replay-safe
A valid payment webhook directly incremented a user balance, but no provider event ID was recorded. A normal webhook retry could credit the same purchase twice.
webhook → grantCredits(handle, amount) · no idempotency key
P1 RACE
“Once per day” was a read-then-write race
Two concurrent requests could both see zero attempts, both run the expensive model, both write a result, and both grant the success reward. The UI promise was stronger than the database guarantee.
countToday() → execute() → insert() → reward() · no atomic claim
P1 DRIFT
An entire previous product was still live
More than 1,000 lines from an earlier product pivot remained reachable at a polished public route, with its own database tables and submission workflow, despite disappearing from navigation and strategy.
live route + persistence + admin queue · absent from nav and sitemap
P2 SEO
The flagship route was missing from the sitemap
The newest, prominently promoted feature was linked in navigation but omitted from the dynamically generated sitemap, while lower-priority legacy pages were included.
navigation: /flagship · sitemap: no /flagship
P2 LOCALE
A Korean product declared itself English
The root document used lang="en" while primary pages and controls were Korean. Screen readers, translation tools, and search engines received the wrong language signal.
<html lang="en"> · Korean product and audience
Security note: identifying details and exploit-ready code are withheld from the public sample. Full clients receive exact source locations and reproduction steps privately.
The workflow
Evidence first. Remediation next.
No giant dashboard, no scanner noise. Every finding must connect a real promise to inspected evidence and a realistic user or business impact.
Map the promises
I inventory public copy, documentation, important flows, routes, jobs, data contracts, and deployment assumptions.
Test the reality
I inspect the live app and repository, trace cross-layer behavior, and reject findings that cannot be evidenced.
Ship the report
You receive severity, reproduction, source locations, impact, and the smallest practical fix in priority order.
First five products
Founding Product Truth Audit
For live web apps built quickly with Claude Code, Cursor, Replit, Lovable, Bolt, Base44, v0, or a similarly fast stack.
- One live web app plus public or read-only repository access
- Delivered within 72 hours after scope, payment, and access are confirmed
- Evidence-backed, severity-ranked findings
- Prioritized remediation plan
- 30-minute report walkthrough
- Five actionable gaps or a full refund
Accountable by name
You know who is reading your code.
RealityDiff is operated directly by Ethan Cho, a product builder and investor based in Seoul. There is no anonymous reviewer pool and no source-code training pipeline.
Ethan Cho
Ex-Google and Qualcomm, currently building and reviewing AI-assisted products. Every audit is performed personally, and every reported gap must connect a product promise to inspected evidence.
Default data handling
Read-only access, non-destructive testing, and no credentials in the intake form. Temporary source checkouts are deleted within 14 days after the report walkthrough unless a different period is agreed. An NDA is available before access.
Straight answers
Before you hand over a repo.
The audit is designed to minimize access and avoid production risk.
Is this a penetration test or compliance certification?
No. RealityDiff is a product-behavior and business-logic audit. It may identify security-relevant gaps, but it does not replace a formal pentest, SOC 2 review, HIPAA assessment, or legal advice.
Do you need write access?
No. Read-only repository access is the default. Live testing is non-destructive. I will not create users, purchases, load, or persistent data without explicit permission.
What happens to private source code?
It is used only to deliver the audit. No source code is published, used for training, or included in public samples. Public case studies require separate approval and are sanitized.
Why not ask my coding agent to review its own work?
You should use it. The missing layer is independence: the same assumptions often shape the product, the tests, and the AI review. RealityDiff starts from the product promise and checks multiple layers against live reality.
When do I pay?
After scope and access are confirmed, before the audit starts. If the final report contains fewer than five actionable, evidence-backed gaps, the fee is refunded in full.
Can you review a live app without repository access?
Yes, as a separately scoped behavioral review. The five-gap guarantee applies only when public or read-only repository access is available, because cross-layer evidence is the core of the full audit.
When will I receive the report?
Within 72 hours after scope, payment, and access are confirmed. If that timing cannot be met, I will tell you before payment.