Access control and secrets
Row-level security on every table with policies that match your product's rules. No key in the bundle. Everything rotated, and checked in CI so it stays that way.
02 · 2–4 weeks
Production Hardening
The app you built, made to survive real users. Quoted from the audit, fixed in writing, delivered on your own accounts by the engineer who wrote the report.
Price
$5K–$15K
Included
Every audit finding closed
Included
Staging, backups, monitoring, CI
Included
Tests on auth and payments
Criticals closedW1
Environments3
Restore, proven1
Pay on deploy50/50
How it works
Where a project lands in the $5K–$15K band depends on what the audit found: how many tables need policies, whether the backend has to be moved, how many flows touch money. The quote comes with the report and does not move unless the scope does. The audit fee comes off it.
Week one is access control and secrets: a policy on every table, service keys out of the client, every secret rotated. Then the ground under it: separate preview, staging and production databases, backups stored somewhere other than the volume they protect and restored once to prove it, environment variables that exist where the app actually runs. Then the things that only show up with traffic: queries that fetch every row, missing indexes, a rate limit on anything that costs you money per call. Then error tracking a human reads, a deploy pipeline that runs the tests, and tests on sign-up, login and payment.
50% to start, 50% on deployment. If the date agreed at scoping is missed, the second half is waived. App Store and Google Play review time does not count against the date. The date moves only if the scope changes in writing.
What you get
Four things land on your side.
Environments and backups
Preview, staging and production as separate databases. Backups outside the thing they back up, restored once so you have seen it work.
Monitoring, CI and tests
Error tracking with alerts to a person, a deploy pipeline that blocks on failing tests, and tests on sign-up, login and payment.
Your accounts, a runbook, 30 days
Deployed on your Vercel, Supabase or AWS, your domain and your Stripe. A short runbook, and a month of fixes after.
How it runs
Production Hardening, week by week.
Scope
Day 0: the audit report is the scope. A fixed price and a date on it; you sign it, 50% is invoiced.
Lock
Week 1: access control, secrets and environments. The critical list is empty by Friday, with a demo to prove it.
Harden
Weeks 2–3: data, performance, monitoring, CI and tests, with a live demo every 3–4 days.
Ship
The agreed date: production on your accounts, runbook, handover. The second 50% on deployment, or waived.
Questions
What people ask before they book.
- Does the app stay in Lovable, Bolt or Replit?
- The code moves to a GitHub repository you own and deploys from there to your own hosting. You can keep editing it with whichever tool you like; the tool reads from the repo. What changes is that the deploy goes through tests, and the database and secrets live in accounts you control.
- Do you rewrite it?
- No. The stack stays: React or Next.js, Supabase or Postgres, Stripe. The audit says which files change, and the hardening changes those. A rewrite is a Build, quoted separately, and the report says so if it is warranted.
- Can you harden it without the audit?
- No, because the price has to come from somewhere. The audit is five days and its fee comes off the hardening, so skipping it would not save you anything.
- How will I know it worked?
- Each item on the checklist is demonstrated on a call: an anonymous request that used to return rows and now returns none, a backup restored to a fresh database, a failing test blocking a deploy. You see each one before the second invoice.
Start here