Vibe coded, and now it has real users.
Built with Lovable, Bolt, Cursor, Replit or Claude Code. It works. Here is what it takes before it can carry a business.
The one that leaks
Log in as one user, change an id in the URL, and see whether you can read someone else's row.
Roughly one in ten Lovable apps in production fails that test, because row level security was never switched on.
Six questions.
No repo access, no sign-up, nothing stored until you send it. Not sure counts as a finding, because not knowing is the finding.
0 of 6 answered.
The production audit.
One weekA fixed week, quoted before anything starts. You get the findings ranked by what they cost you, a plan in the order it should be done, and an hour to walk through it. If we go on to build, it comes off the price.
Access
Who can read and change what, and whether an id in a URL is all it takes.
Secrets
Keys, environments, and what is exposed to the browser.
Money
Webhooks, refunds, and whether subscription state matches reality.
Failure
What happens when something breaks, and whether you find out before a user does.
Cost and speed
Where the bill goes, and what falls over under load it was never sized for.
Recovery
Backups, rollback, and getting back to yesterday.
Before you ask.
Rescue, or rebuild from scratch?
Usually rescue. A rebuild throws away the part that already works, which is the product decisions you got right by talking to users. We recommend a rebuild only where the evidence supports it, and the audit is what produces the evidence.
What does it cost?
The audit is a fixed fee, quoted before anything starts, and it comes off the price if we go on to build. What follows is scoped from what the audit finds rather than from a guess.
How long does it take?
The audit is one week. What follows depends on what is in there, and you will know the shape of it at the end of that week rather than at the end of the project.
Will you rewrite everything?
No. We name what to keep, what to harden and what to replace, in that order, and most of it is usually keep.
What do you need from me?
Read access to the repository and half an hour on what it is meant to do. Never send credentials in an email.
Do you work with Replit, v0, Bolt and Claude Code?
Yes, and with whatever it was actually built on underneath, which is usually Next.js or React Native over Supabase or Firebase.
Is this a penetration test?
No. A pen test tells you what an attacker could do today. This tells you what has to be true before you can run a business on it.
While you are here.
The rescue is one thing this practice does. These are the other four.
Platforms, front to back.
Next.js from the database to the deploy, including the infrastructure under it. Built to be handed over and run by your team, not to be re-bought from us every quarter.
What you get