What we do · For founders who shipped with AI
You shipped it. Now find out what is wrong with it.
You built something real with Lovable, Bolt, Cursor or v0. It works, and you have a quiet feeling something in there will break. A senior engineer reviews it and tells you plainly, in order of risk.
- Price
- $500, one-time, invoiced after the report
- Report
- Within a week of the call
- We need
- Read access and a link to the live app
- You get
- Findings ranked by risk, and a plain answer on harden or rebuild
-
Lovable -
Bolt -
Cursor -
v0 -
Replit -
Bubble -
Supabase - Firebase
In short
The MVP audit is a senior engineering review of an app built with an AI tool or by a freelancer. We check security, the data model, scale limits, failure handling, the interface and operations against the live app and the code, and send a written report within a week, ranked by risk. It costs $500.
Is this you?
Most founders who book this say one of these.
- “It works, but I do not understand how, and I am afraid to change anything.”
- “I know there are security holes in here. I do not know where.”
- “It is fine with ten users. I have no idea what happens with a thousand.”
- “I am about to show this to an investor or a paying customer.”
- “Only the tool or the freelancer who built it can deploy it.”
- “I want someone senior to look at it who is not trying to sell me a rebuild.”
MVP audit
Find it before your users do.
Most AI-built apps we see ship with at least one table anyone can read. The check that finds it takes twenty minutes; the report tells you every other one.
Book the MVP audit
What gets checked
Six areas. The whole scope.
So you know what you are buying, and we know what we owe you.
- 01Security and access
Keys shipped to the browser, endpoints anyone can call, auth checked in the interface but not on the server, and row-level security switched off on tables. This is where AI builders most often leave the door open, because nothing visibly breaks.
- 02Data model
Whether the schema survives the next thousand records: missing indexes, relationships stored as duplicated columns, no migrations, and the tables you will regret when you need to report on them.
- 03What breaks at scale
Where it falls over, at 100 users, 1,000 or 10,000. Queries that run once per row, unbounded model calls, and per-request costs that turn a working product into an expensive one.
- 04Failure handling
What happens when a third-party call times out, a payment webhook arrives twice, or a job half-finishes. Generated code is usually written for the happy path, and silent failure is the normal result.
- 05Interface and usability
Why it reads as generated: default palette, identical section rhythm, small type, mobile layouts that overflow. Plus the places users get stuck or drop out.
- 06Deploy and operations
Secrets in the repository, one environment doing the job of three, no backups, no error monitoring. Fine until the first bad day.
What you receive
A report you can act on the same day.
- Every finding ranked by severity: critical, high, medium, low
- For each one: what is wrong, what it costs you if it stays, and how to fix it
- The ten-minute fixes listed separately, so you can do them today
- A plain answer to the real question: harden what you have, or rebuild the part that will not survive
- A short call to walk you through it
How it runs
From access to report in a week.
- 1Send access
Read access to the repository or project, a link to the live app, and a note on what worries you. Five minutes of your time.
- 2The call
Thirty minutes. You walk us through what it does and where you are worried. We ask the questions that decide where to dig.
- 3The review
A senior engineer works through all six areas against the live app and the code, logged out and logged in.
- 4The report
Within a week: the ranked findings, the quick fixes, and a walkthrough call. Then the invoice.
The offer
$500. Six areas. A ranked report within a week.
If the app is fine for its stage, the report says so. If it needs work, you decide whether to fix it yourself or have us harden it at a fixed price.
- Price$500, one-time, invoiced after the report.
- TimeReport within a week of the call.
- AccessRead only. We never need to change your code to review it.
- AfterFix it yourself from the report, or ask us to harden it.
When not to book this
Three cases where you would be wasting your money.
- You have not shipped anything yet. There is nothing to review; book thirty minutes about what to build instead.
- You want the fixes made, not listed. That is the Harden offer, quoted after the review or directly.
- You already have a senior engineer on the team. They will find most of this themselves.
Questions
What founders ask before booking.
What do I receive?
A written report within a week of the call. Every finding ranked by severity, with what is wrong, what it costs you if it stays, and how to fix it. It ends with a plain answer: harden what you have, or rebuild the part that will not survive.
How much does it cost, and when do I pay?
$500, one-time, invoiced after the report. Nothing is collected on this site and you are not charged to book.
Will you tell me the code is bad and then sell me a rebuild?
No. Plenty of AI-built products are fine for their stage, and the honest answer is to leave them alone. If that is the case, the report says so.
Which tools do you review?
Apps built with Lovable, Bolt, Cursor, v0, Replit and Bubble, on Supabase, Firebase or a database you host. If the code sits inside a no-code platform, a shared view of the workspace works.
What do you need from me?
Read access to the repository or project, a link to the live version, and thirty minutes on a call. We never need write access for the review.
Can you fix what you find?
Yes, through the Harden offer, at a fixed price agreed after the review. You are under no obligation to take it.
Related
- What we do
Harden
We make the fixes: security, data model, deploys and monitoring, at a fixed price.
- Customer story
A multi-tenant platform, isolated by row
Every read scoped to the caller's workspace with row-level security.
- Blog
How much should an AI agent be allowed to do?
The permission model behind every agent we build.
- Integrations
Supabase
What we build on it, and how we secure it.
MVP audit
Know what is wrong before your users find it.
$500, a thirty-minute call, and a written report within a week. If your build is fine as it is, the report will say so.
Book the MVP audit