If your AI-built v1 breaks under real users, that's a fixable problem.
You built it in Lovable, Bolt, v0, Cursor, or Replit. It works in the demo. Then a real customer logged in, something leaked, something crashed, and nobody can tell you why. I take AI-generated codebases to production without throwing away what you have.
The kind of thing I find in week one
AI tools are great at making something work. They're bad at knowing what happens when the wrong person is on the other end of the request.
// client-side component const res = await fetch("https://api.vendor.com/v1/charge", { headers: { Authorization: "Bearer sk_live_8f2…" }, body: JSON.stringify({ amount, customerId }) });
// app/api/charge/route.ts export async function POST(req) { const user = await requireUser(req); const body = ChargeSchema.parse(await req.json()); return vendor.charge({ ...body, customerId: user.customerId }, { apiKey: process.env.VENDOR_KEY }); }
Four steps to production
Code audit
Two weeks. Security, stability, data model, deploy pipeline. You get a written report whether or not you continue.
Prioritized fix plan
What's critical, what's important, what can wait. A fixed price. You approve before anything changes.
Fix and harden
Auth, input validation, error handling, tests, query optimization, secrets management. Same UI, solid foundation.
Deploy and watch
CI/CD, monitoring, backups, and a first-week watch after launch so nothing surprises you.
What usually needs fixing
- Hardcoded secrets and API keys
- Missing or client-side-only auth
- No input validation
- Open database rules
- Crashes on edge cases
- No error handling or retries
- Race conditions on writes
- Zero test coverage
- N+1 queries
- Everything in one giant file
- No migrations, no backups
- Deploys by hand
Tools I work with regularly: Cursor, Lovable, v0, Bolt, Replit, Windsurf, GitHub Copilot, Claude Code, and general LLM-generated code.
Fix it yourself vs. agency vs. Product Advantage
| Keep prompting | Dev agency | Product Advantage | |
|---|---|---|---|
| Timeline | Indefinite | 6–12 weeks | 2–6 weeks |
| Cost | Your time, plus the breach | $20K–$80K+ | $1,500 audit, then $15K–$50K fixed |
| Who touches the code | You and the model | Whoever is on the bench | One senior engineer |
| Your UI | Keeps drifting | Often rebuilt | Stays the same |
| Afterwards | Same problem next month | Maintenance contract | Code you or any engineer can maintain |
Rescue questions
What is "vibe coding"?
Building software by describing what you want to an AI tool and accepting what it produces. It's a fast way to get to a working demo and a slow way to find out what the demo doesn't handle.
Can my app actually be fixed, or does it need a rebuild?
Usually fixed. Most AI-built apps have a reasonable UI and a fragile backend. The audit tells you which. If a rebuild is genuinely cheaper, the report says so and I'll quote that instead.
How long does a rescue take?
The audit is two weeks. Rescues typically run 2–6 weeks after that, depending on what the audit finds.
What does it cost?
The audit is a flat $1,500. Rescues are fixed price, typically $15,000–$50,000. You approve the scope before any fix work starts.
Will my UI change?
No. The goal is the same product with a backend that doesn't fall over. Visual changes happen only if you ask for them.
What if I keep building with AI tools afterwards?
Good. The rescue leaves you with structure, tests, and guardrails so the tools produce better output. I'll show you how to prompt within that structure.
Get a code audit.
Two weeks, a written report, and a fixed price for whatever it finds.