Make your AI-built app production-ready.
| ID | Risk | Severity | Status |
|---|---|---|---|
| R1 | Row-level security disabled on 3 of 9 tables | Blocking | Fixed |
| R2 | Service-role key present in client bundle | Blocking | Fixed |
| R3 | No automated tests around checkout | Blocking | In sprint |
| R4 | Retries on payment webhook not idempotent | Advisory | In sprint |
R1: row-level security on invoices
-- migrations/0007_invoices_rls.sql-- RLS disabled: any signed-in user can read every invoicealter table invoices enable row level security;create policy "own invoices" on invoices for select using (auth.uid() = user_id);
Test added: user A requesting user B's invoice gets nothing back.
Who this is for
You have a working demo built with Lovable, Bolt, Cursor, Replit, v0, Claude Code or a mix. Users are arriving, or investors are asking, and the app is failing in ways you can't reproduce or fix with more prompting.
What we usually find
- One customer could see another customer's information
- Your passwords and keys are visible to anyone who views the page source
- If data is lost, there is no reliable copy to restore
- If Stripe or your email service hiccups, the whole app stops
- Nothing automatically checks that paying and signing up still work after a change
- It gets slow or crashes when you get busy
- If an update breaks something, there's no quick way back
- Nobody checks whether the AI's answers are right, and there's no plan for when they're wrong
Start here: Two-day triage
$349, two working days
A senior engineer reads your repository and hosting setup and returns the five risks most likely to hurt you first, an indicative range for fixing them, and a recommendation: fix, harden fully, or in rare cases rebuild. Fixed price, paid upfront. 50% is credited against any sprint that follows within 30 days. Choose this if you want a fast, honest read before spending more.
If the triage finds nothing that blocks launch, the triage is free.
Step 1: Production Readiness Audit
$1,500, five working days
We review twelve domains: architecture, authentication, authorisation, data, security, reliability, testing, performance, AI features, observability, deployment and cost. You get a scored report, a prioritised risk register and a fixed-price remediation proposal. 50% of the audit fee is credited against that proposal if you proceed within 30 days. Choose this if real users, payments or sensitive data are already live, or if you need a fixed quote rather than a range. Read the checklist we use.
Step 2: Hardening sprint
From $2,500, one to five weeks
Scope is fixed from the triage or the audit. A one-to-two-week stabilisation (from $2,500) closes the findings that block launch. A three-to-five-week production hardening (from $6,000) covers row-level permissions, secrets and environment separation, migrations and backups, failure handling and idempotent retries, automated tests around money and data, CI with one-step rollback, error tracking and cost monitoring. Delivered to production, not to a staging branch.
Also: Migrate off the builder
Fixing the app is one problem; still being locked inside Lovable, Bolt or Replit afterwards is another. When it's the right call, we move the codebase to a standard repository, hosting and database you control, without a rebuild. Scoped and priced from the triage or audit.
Step 3: Managed AI engineering
From $1,500 a month
Optional. We keep owning reliability after launch. See Managed AI engineering.
Not included
Rebuilding from scratch (the triage or audit will tell you if that is the honest answer). New feature development, which is AI integration. Design or marketing work, which we route to partners.
What happens next
Book the triage or the audit. Within one working day you get a short intake form asking for repository access, hosting details and the three things you most want to stop worrying about. Two working days later (triage) or five (audit) you have the report and a call to walk through it.
Tell us what's breaking, or what's slow.
We take on a limited number of engagements at a time and reply to every message, including the ones we're not the right fit for.