Get your Lovable, Bolt or Cursor app ready for real users

You built it. Before real users pile in, we check the parts that handle their logins, data and money, and tell you what to fix and what to leave alone. It takes 3–5 days.

Book a discovery callWhat we check
Sample

Launch audit: a booking app built with an AI tool

Fix before launch
Any signed-in user can download everyone's bookings, names and phone numbers. The database has no access rules. Adding them takes an afternoon.
Fix before launch
Checkout trusts the price the browser sends, so someone could pay $1 for a $90 class. The server should look the price up itself.
Fix before launch
The Stripe secret key is in the page's code, where anyone can copy it. Move it to the server and replace the key today.
Fix soon
Nothing reports errors. The first you'll hear of a crash is from a customer.
Leave alone
Sign-up, booking and the design all hold up. Don't let anyone talk you into rebuilding them.

Verdict: repair it. About two weeks of work.

What we check

AI tools are good at code that works and less good at code that is safe or ready to grow. If you've burned credits going round in fix loops, or the AI says something is fixed and it isn't, these are usually why. We test what the app actually does, not what the AI says it did.

Want to run the checks yourself first? Read the free checklist.

Who can read the data
Whether the database lets one signed-in user read another user's records. In Lovable and Bolt apps on Supabase, that usually means row-level security rules nobody checked, and it is the most common serious gap in vibe-coded apps.
Who can act as an admin
Whether admin pages and roles are checked on the server, or only hidden in the browser.
Where prices and amounts are set
Whether checkout trusts numbers the browser sends, so someone could change what they pay.
Where the secret keys are
Whether payment, AI or database keys are in the page's code, where anyone can copy them.
Payments and webhooks
Whether "payment succeeded" messages are verified, and what happens when a payment fails halfway.
Errors, backups and limits
Whether anything reports crashes, whether backups exist and restore, and whether logins and AI features have limits that stop abuse or a surprise bill.
Will it hold as you grow, and at what cost
Whether pages slow down as your data grows, from database calls inside loops, missing pagination or missing indexes, and where your hosting, database or AI bill will jump as users arrive, with the cheapest ways to keep it down. Scaling work is quoted on your app and how far you want to grow.

What you get

  • A written report you keep. Every finding in plain words, marked fix before launch, fix soon, or leave alone.
  • A straight verdict. Repair or rebuild, with a rough time for each fix.
  • A call to walk through it. Ask anything. The report is yours, whoever does the work.

How it works

  1. A 30-minute discovery call

    Tell us what the app does and what worries you. We say whether a launch audit is the right next step.

  2. Read-only access

    You share the code and, if there is one, a test version of the app. We don't touch live customer data.

  3. The report, 3–5 days later

    We send the report and go through it with you on a call. If the app needs a rescue, the fix sprint starts from the report.

Prices

You get a fixed price after the audit, before any fix begins. The audit fee comes off the fix sprint if you go ahead.

Launch audit
A written report and a straight answer
3–5 days$2,500
Fix sprint
Make it hold
2 weeksfrom $8,000
Support
Keep it fixed
Monthlyfrom $3,000 a month

Questions about the launch audit

How long does a launch audit take?
3–5 days from when you share access to the code. Most of that time is reading the code and testing the parts that handle logins, data and money.
How much does it cost to fix a Lovable app?
Start with a launch audit: $2,500 over 3–5 days, so you know exactly what's wrong before paying for fixes. Most fixes fit in a 2-week fix sprint from $8,000, and the launch audit fee comes off it. Bigger rebuilds are quoted after the launch audit, before any work starts.
Which tools do you check apps from?
Apps built with Lovable, Bolt, Cursor, Windsurf, Replit, Base44, v0 and similar tools, or with code from ChatGPT or Claude, often on Supabase or Firebase. What matters is the code and the services it runs on, not which tool wrote it.
Can you help my app scale?
Yes. The launch audit shows where the app will slow down or get expensive as users arrive. Scaling work after that is quoted on your app and how far you want to grow.
How do I keep my app's running costs down as it grows?
Most of the bill comes from a few places: AI calls, database reads and file storage. The usual savings are caching answers instead of asking the AI again, using a smaller model where it's good enough, limits per user, and loading only the data a page needs. The launch audit shows where your costs will grow and what to change first.
Do you need access to my code?
Yes, read-only access to the code and, if you have one, a test version of the app. We don't need access to your live customer data.
Will you tell me to rebuild everything?
Only if the foundations won't hold. Most apps need a short list of fixes, and the report says which parts to keep as they are.
Isn't a $100 fix enough?
A quick fix solves the bug you can see. The launch audit looks at the whole app, including the problems that don't show until real users arrive, and gives you a written verdict. If all you need is one small fix, we'll say so on the discovery call.
The AI says it fixed the problem. How do I know it did?
Test it the way a real user would, not by asking the AI again. That's what the launch audit does: we sign in as different kinds of users and try what they could try, so the report reflects what the app actually does.
What if nothing serious turns up?
Then the report says so, and you launch knowing the risky parts have been checked.

Not sure it's safe to launch?

A 30-minute call, and you'll know whether a launch audit is worth it before you pay for one.

Book a discovery call