For founders
You built it with AI. We make it safe to sell.
From AI-built prototype to production:a readiness audit. a launch sprint. a rebuild. a retainer. a compliance response.
Five business days, a severity-ranked report, a fixed quote.
For founders with a working prototype and customers waiting. A fixed-price audit in five business days, then the sprint that takes it to production.
Where AI-built apps break
- Row-level security off: anyone with the public key can read every table.
- Sign-in checked in the browser only, so a direct request skips it.
- Secrets in public environment variables, shipped to every visitor.
- Stripe still in test mode, or live with no webhook verification.
- No staging and no tests, so every change is a gamble with real users.
- AI calls with no limits, and a bill that grows with every signup.
How it works
Send the repository or the URL. In five business days you get a report that ranks every finding by severity, a call where we say whether to stabilise or rebuild, and a fixed quote for the sprint. The audit fee is credited to it.
The sprint fixes the critical and high findings first: who can read what, how money moves, what happens when something fails. Then the things that make it sellable: tests on the paths that take payment, error tracking, analytics that respect consent, an accessibility baseline and the search basics.
What you end up with
- An app you can put in front of a security questionnaire.
- A staging environment and a test suite that run on every change.
- Your code, in your accounts, with a written record of what changed and why.
- Someone to call when it breaks, if you want that.
What it costs
- Production Readiness Audit
- $2,500
- Five business days. Repo or URL in; a severity-ranked report, a rewrite-or-stabilise call and a fixed quote out. Credited to the sprint.
- Launch Sprint
- $7,500–12,000
- Two to three weeks. Auth and row-level security, secrets, Stripe live mode and webhooks, staging and CI, tests on the money paths, error tracking, analytics with consent, an accessibility baseline, the SEO basics.
- Rebuild to Production
- From $15,000
- When the audit says stabilising won't hold. Keep the validated screens and flows, rebuild what's underneath.
- Production Retainer
- $3,000 or $6,000 a month
- Monitoring, fixes, a monthly security re-scan and fractional CTO hours. The higher track adds Elizabeth on marketing.
- Compliance Response
- $3,500
- A WCAG 2.1 AA audit, a remediation plan and a VPAT, for a demand letter, a procurement request or the European Accessibility Act.
Every price is fixed before the work starts and holds unless the scope changes. Anything outside a package is quoted by the hour, in writing, first.
Questions
- Do we have to rewrite?
- Usually not. The audit ends with a rewrite-or-stabilise call based on what we found, and most apps are stabilised. A rebuild is for the ones where the data model or the security can't be patched.
- Can you work inside Lovable, Bolt or Replit?
- Yes. We work in the repository through Git sync, so your team keeps its tool and we keep the changes reviewable. Some fixes have to move out of the tool, and the audit says which.
- Who owns the code and the accounts?
- You do. The repository, the hosting, the database, Stripe and the domain are in your accounts from the first day, with us as collaborators.
- We're already live with paying users.
- Then the audit comes first and the fixes are ordered by risk, with no downtime. Payments and sign-in are checked before anything cosmetic.
- How fast is it?
- The audit takes five business days from access to the report. The launch sprint takes two to three weeks. A rebuild is quoted with its own date.
- What happens after launch?
- The retainer keeps it monitored and patched, with fractional CTO hours for what comes next. Or we hand it over, documented and tested, to whoever runs it.
Let’s talk
Tell us what’s going on.
A few lines is enough. One of us replies by email, usually with a question or two.