Prices

Five numbers, all of them published.

No “contact us for a quote”. The audit is fixed, the hardening is quoted from the audit, a build is priced on a 30-minute call. The number in writing is the number on the invoice. 50% to start, 50% on deployment. If the date agreed at scoping is missed, the second half is waived.

Book a 30-min callWrite instead

Already built it

Audit, harden, keep it running.

For an app that exists, in Lovable, Bolt, v0, Replit, Cursor or anything else, and needs to survive real users.

011 week

Production Audit

$1.5K

Your Lovable, Bolt, Cursor or Replit app read line by line against a published checklist. A written report in five days: every finding, its severity, the fix and what the fix costs.

  • The report
  • The critical fixes, done
  • A quoted price and a date
  • A thirty-minute walkthrough
What’s in it
022–4 weeks

Production Hardening

$5K–$15K

Every finding in the audit fixed, the app moved off the builder's sandbox onto your accounts with staging, backups, monitoring and tests on the paths that touch money. A date in the contract.

  • Access control and secrets
  • Environments and backups
  • Monitoring, CI and tests
  • Your accounts, a runbook, 30 days
What’s in it
0360–80 h / month

Retainer

from $3K/mo

The engineer who hardened it keeps it running. Senior hours every month for features, releases, infrastructure cost and the next thing the tool generates. Same-day for anything that is down.

  • 60–80 senior hours
  • Weekly planning, daily Slack
  • Review before release
  • Same-day emergency support
What’s in it

The checklist

What the audit reads your app against.

Published in full. The $1.5K fixed Production Audit works through every line of it against the real code and the real database, and the report is organised the same way.

Access control

  • Row-level security enabled on every table, including the ones the tool added last week
  • Policies that match the product's rules, not just auth.uid() = user_id on everything
  • Views, functions and edge functions that bypass the policies
  • Admin routes and roles that are checked on the server, not in the UI
  • Authorisation that trusts user-writable metadata

Secrets

  • Service-role, OpenAI, Anthropic and Stripe secret keys in the client bundle
  • Keys in git history, in error-tracking payloads or in public forum pastes
  • Rotation of anything that was ever exposed
  • Webhook signatures verified

Data and environments

  • Preview, staging and production as separate databases
  • Backups stored outside the volume they protect, with one restore done to prove it
  • Tokens the agent can reach scoped to the environment it works in
  • Migrations under version control, not applied by hand

Deploy

  • Every environment variable present where the app actually runs
  • A deploy that fails when the tests fail
  • A domain, TLS and a rollback that has been tried once
  • The first request after deploy, exercised

Performance and cost

  • Screens that fetch every row, and the indexes they would need
  • N+1 queries behind lists
  • Rate limits on anything that costs money per call, model endpoints first
  • What the hosting, database and model bills look like at ten times the users

Errors and tests

  • Error tracking that alerts a person, with the user's action attached
  • Tests on sign-up, login and payment
  • A test that proves a stranger cannot read another user's rows
  • A runbook: what runs where, and what to do when it stops

Nothing built yet

Built from scratch, by the same engineer.

For an idea that is still an idea. The same stack the hardening lands on, so there is nothing to audit later.

042–4 weeks

MVP Sprint

$5K

One web app, one core flow, auth, Stripe, deployed on your accounts. A URL by day 5 and a launch date in the contract.

  • The core flow, end to end
  • Auth, Stripe and one integration
  • Deployed on your accounts
  • Source, docs, 30 days of support
What’s in it
054–8 weeks

Product Build

$10K–$25K

The full product: web, iOS and Android from one codebase, several flows, an admin, AI features where they earn their place. Submitted to both stores.

  • Web app and admin
  • iOS and Android apps
  • AI features where they earn their place
  • Stores, source, 30 days of support
What’s in it

How you pay

Two invoices, one date.

The scoping call ends in a one-page scope with the price and the launch date on it. That page is the contract.

50%
Invoiced when you sign the scope. Work starts the following Monday.
50%
Invoiced on deployment, on or before the agreed date. Thirty days of support follow.
0%
If the date agreed at scoping is missed, the second half is waived. App Store and Google Play review time does not count against the date. The date moves only if the scope changes in writing.

What $5K does not include

Six things the MVP Sprint leaves out, on purpose.

They are written here so the scoping call has nothing to surprise you with. Each one is either the Product Build or an add-on quoted before it is built.

Web only

Native iOS and Android apps are the Product Build. The web app is built so they can be added from the same codebase later.

System UI, not a brand

Clean, fast and consistent, on the same design system as this site. Custom brand design or a designer's Figma is scoped separately.

Stripe only

One payment provider. Subscriptions or one-off payments, wired and tested, but not a second provider.

One extra integration

Auth and Stripe are included, plus one more third-party API: email, maps, a CRM. Further ones are quoted before they are built.

Your accounts

You create Vercel or AWS, Supabase or Neon, Stripe and the domain. Codeks deploys into them, so you own everything from the first day.

About eight screens

One core flow, end to end. If the idea needs more than that, the scoping call says so before the price is agreed.

The terms

What you can hold me to.

Four commitments that are in every hardening and build contract, whichever tier you pick.

The price on the card is the price on the invoice.

Fixed fee, agreed before the first commit. Scope changes are quoted before they are built, never after.

Miss the date, and the second half is waived.

The launch date is agreed in writing at the scoping call. 50% to start, 50% on deployment. App Store and Google Play review time does not count against the date. The date moves only if the scope changes in writing.

You own everything from the first commit.

Source, documentation and infrastructure live in your accounts. There is nothing to hand back.

One engineer, start to finish.

The person on the scoping call writes the code. There is nobody to hand off to.

Questions

Questions about the numbers.

How much does it cost to make a vibe-coded app production-ready?
$1.5K fixed for the audit, then $5K–$15K for the hardening, quoted from the report and fixed in writing. The audit fee comes off the hardening. Where it lands in the band depends on how many tables need policies, whether the backend moves, and how many flows touch money.
Why not just run the tool's security scan?
Run it. It catches tables with no RLS at all, and it is free. It does not read your policies for logic errors, it does not know a service key is in a client fetch, it does not look at your hosting account or your backups. The audit is the part a scanner cannot do.
Do you still build apps from scratch?
Yes. The MVP Sprint is $5K fixed: a web app with auth, one core flow and Stripe in two to four weeks. The Product Build is $10K–$25K for web, iOS and Android from one codebase. Same guarantee, same engineer.
What happens if you miss the date?
50% to start, 50% on deployment. If the date agreed at scoping is missed, the second half is waived. App Store and Google Play review time does not count against the date. The date moves only if the scope changes in writing.
Do I own the code?
Yes, and you always did. The repository, the documentation and the infrastructure live in your own GitHub, Vercel or AWS, Supabase and Stripe accounts. There is nothing to hand back and nothing to be locked into.
Is this cheaper than an agency? Cheaper than Upwork or Fiverr?
Cheaper than an agency, more expensive than a marketplace freelancer, and priced in advance either way. An agency usually quotes more and takes longer for the same scope. A freelancer may quote less, but you carry the risk of the developer who goes quiet. Here one senior engineer is contractually on the hook for a date.
Do you take equity instead of cash?
No. Fixed price, paid in two halves. Equity conversations distort scope and timelines for both sides.
How do I start?
Book a 30-minute call, or write two sentences about what the app does and which tool built it. You leave the call with a scope, a price and a start date in writing.

Start here

Your product could be live in four weeks, at a price you already know.

Thirty minutes, no deck. Bring the problem and you leave with a scope, a price and a start date.

Book the call