Need Help Fixing or Securing
Your Vibe-Coded App?
Can you access your own database with a public key anyone can grab from your frontend?
Do you have a functioning, tested, documented process for resetting a user's password?
Are you validating webhooks from payment processors to make sure users can't lie about having completed payment?
Have you added rate-limiting to auth and LLM endpoints, to make it harder for someone to sign-up a bunch of free accounts and hammer your API?
Can you get notified on your phone when something goes wrong in prod, and find out what went wrong by searching through detailed, well-structured logs?
If the answer to any of those questions was "I don't know" or "nah", and your app is facing real users, we need to talk.
Tools like Lovable and Bolt and Replit are great.
They can help you build user-facing applications, create new features, write CSS, build animations. But AI-generated apps can have insecure or incomplete backends that can put your app and business at risk. We'll review the AI-written codebase, prioritise fixes, and help you shore up any gaps.
What happens
You give us read-access to your codebase, hosting, databases, any third-party tools you're using, as well as an empowered point-person to answer questions. We scope what we plan to look at and charge. Then we dig in, looking for:
Security vulnerabilities that need fixing right away. For example, row-level security might be disabled, allowing anyone to read/write any data in the database. Payment processor credentials might be in your JS bundle. Your app might think it has an authorisation system, but anyone can make themselves an admin just by setting a JS variable. We'll fix any active fires immediately, yanking any exposed secrets and making sure we've copied the data we need to understand what happened, then figure out what went wrong and how to fix it. Your team's legal/privacy/communications experts are best-placed to decide whether users need to be notified. We're happy to answer questions, but leave the call to you.
Gaps where AI took shortcuts. Missing tests, TODOs, questions, and other signs that AI knew something was incomplete or shaky. We'll fill in what's missing or suggest improvements.
Ops and other gaps where AI didn't write any code. AI doesn't write code for error-states unless you tell it to. Missing features like logging, backups, monitoring. We'll add these so that you have confidence that your app will work when you need it to.
Once we've identified anything needing attention, we'll share our recommendations for improvements, prioritisation, timeline, and cost.
If you'd like us to address them, we'll rebuild critical pieces of the application's backend such as authentication, payment webhooks, rate-limiting, file uploads, and complicated database queries, then retest and redeploy the app. We'll share a summary of everything we did, anything you can/should build yourself with AI, and hand off with logging, monitoring, backups, and alerts all in place. We're happy to continue helping on retainer to build new features and iterate. We'll continue to use any existing frontend/UI code that isn't broken. No need to throw the baby out with the bathwater.
Want to see if we're the right fit?
Fill out the form with your app's link, link to the codebase or share access, who you plan to let it loose upon. We'll take a look and tell you what we think.