RLS_DISABLED
Your database is open
Supabase tables without row-level security let anyone with your public key read or change other users’ data.
Production rescue for AI-built apps
It worked in preview. Now it works in production.
You built it with Lovable, Bolt, Cursor or Replit. We make it secure, fast and reliable enough for real users — in 7 days, at a fixed price, without rewriting it.
PreviewProduction
Click or drag
We fix apps built with
- Lovable
- Bolt.new
- Cursor
- Replit
- v0
- Windsurf
- Claude Code
- Supabase
- Firebase
- Vercel
- Netlify
- Stripe
01 / The problem
The last 20% is where AI-built apps break.
AI tools are brilliant at the first version. Real users, real data and real money find everything they skipped.
SECRET_IN_BUNDLE
Keys shipped to every browser
OpenAI, Stripe or service-role keys baked into the frontend, waiting for the first person who opens DevTools.
AUTH_EDGE_CASE
Auth that almost works
Password resets, sessions, roles and redirects that hold up on the happy path and fall apart everywhere else.
WEBHOOK_UNVERIFIED
Payments that quietly drop
Stripe webhooks without signature checks, retries or idempotency. Paying customers without access — or the reverse.
PERF_CLIFF
Fast for one, slow for a hundred
Missing indexes, N+1 queries, multi-megabyte bundles and no caching. Fine in the demo, painful at launch.
PREVIEW_DRIFT
Preview ≠ production
Env vars, CORS, domains, migrations and builds that only ever worked inside the editor.
02 / Free production scan
See what your users’ browsers already see.
Paste your app’s URL. In about 20 seconds we map the tables, functions and pages your code reveals, and check for exposed keys, public source maps and missing security headers.
- $ awaiting a URL…
Supabase self-check
The part no outside scan can see.
Most leaks in AI-built apps live in database rules, not in the page. Run this read-only query in your own Supabase project: in a few seconds it lists open tables, catch-all policies, leaky views and public buckets.
- Open your project → SQL Editor → New query.
- Paste the query and press Run.
- Read the severity column.
- Critical
- Anyone with your public key can read or change the data. Fix today.
- High
- Open to every visitor or every signed-in user.
- Review
- Fine for public data, a leak for private data.
- OK
- Nothing open. Login flows and payments still need a human look.
It reads only Postgres’s own catalog: table names and settings. It never touches your rows, changes nothing, and nothing is sent to us.
Found something red? Send us a screenshot of the result. It holds table names only, no data. We’ll reply with what to fix first and a fixed price.
Send the result03 / Process
From “it works on my screen” to launch-ready.
-
01
Scan
Free, 20 seconds. A first look at what is exposed to the public.
Free
-
02
Audit
We go through your repo, database and hosting. You get a prioritised written report and a walkthrough call.
48 hours
-
03
Fix sprint
We fix everything in scope as pull requests in your repo, with daily updates and plain-English explanations.
7 days
-
04
Care
Monitoring, security updates and small features every month, so it stays production-grade as you grow.
Monthly
04 / What we fix
Everything between the demo and day one.
Security
- Row-level security policies
- Secret rotation & server-side keys
- Auth, sessions & roles
- Headers & Content-Security-Policy
Payments
- Verified Stripe webhooks
- Subscriptions & entitlements
- Idempotent checkout flows
- Refunds & failed payments
Performance
- Queries & indexes
- Bundle size & code splitting
- Caching & images
- SEO & link previews
Reliability
- Error tracking & alerts
- Backups & migrations
- Tests on critical paths
- CI/CD & environments
- React
- Next.js
- Vite
- TypeScript
- Supabase
- Postgres
- Firebase
- Stripe
- Vercel
- Netlify
- Cloudflare
- Expo / React Native
05 / Build
When it’s stable, we build what’s next.
The same team that takes AI-built apps to production builds new ones — with security, payments and monitoring in place from the first commit.
PROTOTYPE_TO_V2
Prototype → V2
Your Lovable or Bolt prototype proved the idea. We rebuild what won’t scale and keep what works.
- Architecture & data model review
- Rebuild of the weak parts, not everything
- Migration with zero data loss
NEW_WEB_APP
New web app
SaaS products, dashboards, marketplaces and internal tools — designed, built and shipped.
- Auth, roles & Stripe billing
- Admin panel & analytics
- Next.js, Supabase or Postgres
NEW_MOBILE_APP
Mobile app
iOS and Android from one codebase with React Native and Expo — through to the App Store and Google Play.
- Push notifications & deep links
- In-app purchases & subscriptions
- Store submission & review
Every build ships with
- Security review
- Error tracking
- CI/CD
- Tests on critical paths
- Code in your repo
- 30 days of support
Fixed quote with milestones after a free 30-minute scoping call.
06 / Pricing
Fixed prices. No surprises.
Scope and price are agreed before we start. The audit fee is credited in full toward your fix sprint.
Audit
$399
Delivered in 48 hours
- Security review: RLS, secrets, auth
- Payments & data-flow review
- Performance & deploy check
- Prioritised written report
- 30-minute walkthrough call
Credited toward a fix sprint
Recommended
Fix sprint
from $1,900
7 days, fixed price
- Everything in the audit, fixed
- Pull requests in your repo
- Daily progress updates
- Re-scan & handover notes
- 14 days of post-launch support
Price agreed upfront from the audit
Care
from $390/mo
For apps with real users
- Uptime & error monitoring
- Dependency & security updates
- Monthly health report
- Small fixes & features
- Priority response
Cancel anytime
Our guarantee. If we don’t fix what the audit found within the agreed scope, you don’t pay for the sprint.
07 / What you get
An audit you can actually read.
Every finding comes with what it means for your business, how bad it is, and exactly how we’ll fix it.
Sample report · fictional app
habit-tracker.lovable.app
C58/100
- CriticalAny visitor can read the
profilestable, including emails, with the public anon key.Add RLS · 1h - HighStripe webhook accepts unsigned events — anyone can grant themselves a paid plan.Verify signature · 2h
- MediumNo Content-Security-Policy; third-party scripts can run anything.Add CSP · 1h
- Low1.9 MB of JavaScript on first load; slow on mobile networks.Split bundle · 3h
08 / FAQ
Questions, answered.
Will you rewrite my app?
No. We keep your stack and your code and fix it in place. If rebuilding a specific part is genuinely cheaper, we’ll say so in the audit — and you decide.
Who owns the code?
You do, always. Every change lands as a pull request in your repository, and we’re happy to sign an NDA before we look at anything.
What do you need from me?
Read access to your repo, limited access to your hosting and database (we’ll tell you exactly which roles), and a 30-minute call.
Do you build new apps from scratch?
Yes — web apps, and iOS/Android apps with React Native and Expo. After a free 30-minute scoping call we send a fixed quote with milestones. If you already have an AI-built prototype, we usually start from it rather than from zero.
My app wasn’t built with an AI tool. Can you still help?
Yes. If it’s a modern web or mobile app — React, Next.js, Vite, Supabase, Firebase, Postgres, Expo — we can audit and harden it.
What if the audit finds more than a sprint can fix?
The audit prioritises everything. We agree the sprint scope and price before starting, so you choose what gets fixed first and nothing is billed by surprise.
Where are you based?
We’re a small remote team working with founders across time zones. We invoice in USD or EUR.