The tables have no row-level security.
The anon key is in the browser by design, so anyone with it can query the database directly. In 2025 that pattern (CVE-2025-48757) left 170 Lovable apps readable by strangers, emails and Stripe data included.
Founder-led · Lovable, Bolt, Cursor, Replit · Published prices
Your vibe-coded app, ready for real users.Audited for $1.5K. Hardened in weeks.
It works in the preview. A senior engineer checks it against a published list, fixes what would break with real users and deploys it on your accounts. Published prices, a date in the contract, your code stays yours.
Audit call outputLive
scope: Lovable app, Supabase + Stripe: RLS, secrets, deploy · $6K · 2 weeks · start Mon
- $1.5K
- Production Audit · report in 5 days
- $5K–$15K
- Production Hardening · 2–4 weeks
- $3K/mo
- Retainer · month to month
The problem
It works in the preview.
Six ways an app built in Lovable, Bolt, Cursor or Replit breaks once strangers, money and a database are involved. Each one has happened to someone, in public.
The API keys are in the bundle.
A SaaS launched with its keys visible in the browser's developer tools. Strangers ran up the bills on them and the product was shut down within the week.
Preview and production are one database.
An agent on Replit deleted a founder's live data during a declared code freeze, then said rollback was impossible. It wasn't. The two environments were the same database.
The backups live inside the thing they back up.
A coding agent on a staging task found a hosting token in an unrelated file and deleted a volume. The backups were stored in that volume. The newest copy left was three months old.
It builds fine and fails on the first real request.
Keys that lived in the builder's sandbox do not ship with the export. A screen that loads every row is instant with twelve records and a bill with twelve thousand.
No tests, and errors go where nobody looks.
In one audit of 26 AI-built apps, 23 had no working test and 17 recorded user-facing errors nowhere a person would see. The next prompt breaks something that worked, and nobody finds out until a user does.
Our approach
A report on day 5, a demo every three days, a date in the contract.
No scanner output and no slide deck. The first deliverable is a written report you can act on, and the last is the app running on your own accounts.
Day 5: a written report.
Every finding with a severity, the file or table it lives in, what it exposes and the fix. Anything that lets a stranger read another user's data is closed during the audit, not after.
Every 3–4 days: a demo of what's closed.
The anonymous request that used to return rows and now returns none. A backup restored to a fresh database. A failing test blocking a deploy. You see each one.
The agreed date: it's live, on your accounts.
Separate environments, backups, monitoring, CI, a runbook. Thirty days of support after. If the date agreed at scoping is missed, the second half is waived.
The checklist
What the audit reads your app against.
Published in full. The $1.5K fixed Production Audit works through every line of it against the real code and the real database, and the report is organised the same way.
Access control
- Row-level security enabled on every table, including the ones the tool added last week
- Policies that match the product's rules, not just auth.uid() = user_id on everything
- Views, functions and edge functions that bypass the policies
- Admin routes and roles that are checked on the server, not in the UI
- Authorisation that trusts user-writable metadata
Secrets
- Service-role, OpenAI, Anthropic and Stripe secret keys in the client bundle
- Keys in git history, in error-tracking payloads or in public forum pastes
- Rotation of anything that was ever exposed
- Webhook signatures verified
Data and environments
- Preview, staging and production as separate databases
- Backups stored outside the volume they protect, with one restore done to prove it
- Tokens the agent can reach scoped to the environment it works in
- Migrations under version control, not applied by hand
Deploy
- Every environment variable present where the app actually runs
- A deploy that fails when the tests fail
- A domain, TLS and a rollback that has been tried once
- The first request after deploy, exercised
Performance and cost
- Screens that fetch every row, and the indexes they would need
- N+1 queries behind lists
- Rate limits on anything that costs money per call, model endpoints first
- What the hosting, database and model bills look like at ten times the users
Errors and tests
- Error tracking that alerts a person, with the user's action attached
- Tests on sign-up, login and payment
- A test that proves a stranger cannot read another user's rows
- A runbook: what runs where, and what to do when it stops
Shipped, not promised
What is live, and where.
Four products you can open today. Each line links to the case, and the case links to the product.
Shipped & live
6 products, all with a URL.
Open one and click around. Nothing here is a mockup or a case study written after the fact.
Resumemasterresumemaster.net
Resumemaster
AI résumé engine · Next.js + React Native · Web + mobile
Codepilotcodepilot.dev
Codepilot
SaaS starter kit · Auth, billing, dashboards · Next.js
Linktobiolinktob.io
Linktobio
Link-in-bio product · Web + mobile app
Month6month6.app
Month6
Fitness app · Six-month projection, training engine, AI coach · iOS
RapidChargerapid-charge.com
RapidCharge
EV charging network app · Live map, booking, payments · iOS + Android
Ordinanca Jetaordinancajeta.com
Ordinanca Jeta
Family medicine practice · Bilingual site, price list, booking · Next.js
What it costs
Audit, harden, keep it running. All of it priced.
No “contact us for a quote”. The audit is fixed, the hardening is quoted from the audit, and the number in the report is the number on the invoice.
011 week
Production Audit
$1.5K
Your Lovable, Bolt, Cursor or Replit app read line by line against a published checklist. A written report in five days: every finding, its severity, the fix and what the fix costs.
- Access control, secrets, data, deploy
- Every finding with a severity and a fix
- A quoted price for the hardening
- Report in five days, fixed
022–4 weeks
Production Hardening
$5K–$15K
Every finding in the audit fixed, the app moved off the builder's sandbox onto your accounts with staging, backups, monitoring and tests on the paths that touch money. A date in the contract.
- Every audit finding closed
- Staging, backups, monitoring, CI
- Tests on auth and payments
- Date in writing, or half is waived
0360–80 h / month
Retainer
from $3K/mo
The engineer who hardened it keeps it running. Senior hours every month for features, releases, infrastructure cost and the next thing the tool generates. Same-day for anything that is down.
- 60–80 senior hours
- Weekly call + daily Slack
- Same-day emergencies
- Month to month
Start with the audit
Nothing built yet? The same engineer builds from scratch: MVP Sprint $5K fixed, Product Build $10K–$25K. See the build tiers
The terms
What you can hold me to.
Four commitments that are in every contract, whichever tier you pick. The date one is the one most people ask about twice.
The price on the card is the price on the invoice.
Fixed fee, agreed before the first commit. Scope changes are quoted before they are built, never after.
Miss the date, and the second half is waived.
The launch date is agreed in writing at the scoping call. 50% to start, 50% on deployment. App Store and Google Play review time does not count against the date. The date moves only if the scope changes in writing.
You own everything from the first commit.
Source, documentation and infrastructure live in your accounts. There is nothing to hand back.
One engineer, start to finish.
The person on the scoping call writes the code. There is nobody to hand off to.
Why this fast, at this price
Anyone can get an app to a working preview now. Getting it to hold up with strangers, money and a database behind it is the work. Codeks sells a date and a number for that work: one senior engineer reads every line, fixes what would break, and is on every call from the audit to the deploy.
- Web
- Next.js
- iOS + Android
- Expo / React Native
- Backend
- Node or NestJS · Python or FastAPI
- Database
- PostgreSQL
- Hosting, your accounts
- Vercel · Supabase · AWS
- Payments and in-app purchases
- Stripe · RevenueCat
- Store builds
- Expo EAS
- Why it is boring
- The same managed pieces products far larger than yours run on. Nothing to rewrite when you grow, nothing a future hire can’t read.
The engineer
Built for
ResumemasterCodepilotLinktobioMonth6RapidChargeOrdinanca JetaCC Sporting EventsTalentFlowCrafted Tools
Questions
What people ask before they book.
- I built my app in Lovable. Is it safe to launch?
- Not by default. Supabase tables are created without row-level security unless something switches it on, the anon key is in the browser by design, and Lovable's own publish check says it cannot guarantee security. The $1.5K fixed Production Audit reads your tables, policies, secrets, backups and deploy against the published checklist and tells you in five days.
- How much does it cost to make a vibe-coded app production-ready?
- $1.5K fixed for the audit, then $5K–$15K for the hardening, quoted from the report and fixed in writing. The audit fee comes off the hardening. Where it lands in the band depends on how many tables need policies, whether the backend moves, and how many flows touch money.
- What does the audit check?
- The checklist on this page: access control, secrets, data and environments, deploy, performance and cost, errors and tests. Every item is checked against the real code and the real database, and every finding is written up with a severity and a fix.
- Why not just run the tool's security scan?
- Run it. It catches tables with no RLS at all, and it is free. It does not read your policies for logic errors, it does not know a service key is in a client fetch, it does not look at your hosting account or your backups. The audit is the part a scanner cannot do.
- Does my app stay in Lovable, Bolt or Replit?
- The code moves to a GitHub repository you own and deploys from there to your own hosting. You keep editing it with whichever tool you like. What changes is that every deploy runs the tests, and the database and secrets live in accounts you control.
- Do you still build apps from scratch?
- Yes. The MVP Sprint is $5K fixed: a web app with auth, one core flow and Stripe in two to four weeks. The Product Build is $10K–$25K for web, iOS and Android from one codebase. Same guarantee, same engineer.
- How fast?
- The audit report lands on day five. Hardening takes two to four weeks, with the critical list empty by the end of week one and a demo every three to four days. A build from scratch is two to eight weeks. The date is in the contract.
- What happens if you miss the date?
- 50% to start, 50% on deployment. If the date agreed at scoping is missed, the second half is waived. App Store and Google Play review time does not count against the date. The date moves only if the scope changes in writing.
- Do I own the code?
- Yes, and you always did. The repository, the documentation and the infrastructure live in your own GitHub, Vercel or AWS, Supabase and Stripe accounts. There is nothing to hand back and nothing to be locked into.
- Is this cheaper than an agency? Cheaper than Upwork or Fiverr?
- Cheaper than an agency, more expensive than a marketplace freelancer, and priced in advance either way. An agency usually quotes more and takes longer for the same scope. A freelancer may quote less, but you carry the risk of the developer who goes quiet. Here one senior engineer is contractually on the hook for a date.
- Do you take equity instead of cash?
- No. Fixed price, paid in two halves. Equity conversations distort scope and timelines for both sides.
- Do you sign an NDA?
- Yes, before the scoping call if you prefer. Send yours or ask for ours.
- Where are you based, and what hours do you work?
- Prishtina, Kosova, on Central European Time. That is a full working-day overlap with Europe and an afternoon overlap with the US East Coast. Daily written updates in a shared Slack channel, one planning call a week and a demo every three to four days.
- How do I start?
- Book a 30-minute call, or write two sentences about what the app does and which tool built it. You leave the call with a scope, a price and a start date in writing.
Start here
Your product could be live in four weeks, at a price you already know.
Thirty minutes, no deck. Bring the problem and you leave with a scope, a price and a start date.