Contact Book a call

What we do · Harden

Your vibe-coded app, made production-grade

Your app was built fast with Lovable, Bolt, Cursor or a freelancer. We make it safe, stable and maintainable before real users and real money depend on it.

Start with the audit Book thirty minutes
Price
Audit $500, report within a week · hardening from $2,500 · rebuild from $8,000
Time
Audit report within a week; hardening ~2 weeks; rebuild 4 to 8 weeks
For
Founders who shipped something real with an AI builder and need it to survive real customers, investors or an audit.
You own
The report

In short

Harden takes an app built with Lovable, Bolt, v0, Cursor or Replit and makes it safe to put real users on. It starts with a fixed-fee audit, $500 with the report within a week, covering security, data model, what breaks at scale and failure handling. The report lists each fix with a fixed price and a keep-or-rebuild recommendation. Hardening starts at $2,500 and takes about two weeks; a rebuild starts at $8,000. Both carry a 30-day warranty.

Is this you?

If three of these sound like your week, hardening your app is the place to start.

  • The app was generated by an AI tool and nobody has reviewed the code
  • You are not sure row-level security is on for every table
  • Keys or secrets may be in the front-end code
  • There are no backups you have tested
  • Only the person who built it can deploy it

What this is not

So the scope is clear before the call.

  • A rewrite for its own sake. We keep what works and fix what is risky.
  • A security certification. We build the controls; the audit is separate.

Most often for

What we have built

Harden in practice.

Harden

Find it before your users do.

Send us the app. In a week you get a list of what is exposed, what will break, and what to fix first, in order of risk.

Get the app checked
A software team working at their desks in an office
Find it before your users do. Photo: cottonbro studio, Pexels.

How it runs

Harden, step by step.

  1. 1Hours 0 to 48

    Read access to the repo and the live app. We check exposed keys, row-level security, auth on every endpoint, the data model, and what happens at a thousand users.

  2. 2Report

    Every finding by severity with a fixed price to fix, and a plain recommendation: harden what you have, or rebuild the part that will not survive.

  3. 3Harden

    Fixes applied in priority order, with tests, a staging environment and a deploy pipeline. Secrets moved out of the code.

  4. 4Warranty

    Thirty days of fixes on anything we touched, at no cost.

What you get

  • The audit report with per-fix prices
  • Security fixes: secrets, auth, row-level rules
  • Tests, staging and a deploy pipeline
  • A keep-or-rebuild recommendation in writing
  • 30-day warranty

How we know it is done

  • No secret in the client-side bundle or the repository
  • Every endpoint checks authorisation on the server
  • The app passes the agreed load test

What you own

  • The report
  • The hardened code, in your repository
  • The pipeline and environments
  • The warranty
~70%

of Lovable-built apps in a May 2025 scan had row-level security disabled

Source: Vibe-coding security research, 2025 to 2026

Built on

The tools you already run, where we can.

“Most vibe-coded apps work. The question is whether they are safe, and the builder does not tell you.”

SBD engineering team

How it starts

Every project starts with an audit.

One to two weeks with the people who do the work. A costed blueprint in order of payback. The $500 is credited in full to the build.

Start with the audit See how we work
  • Audit1 to 2 weeks. $500, credited to your build.
  • BlueprintIncluded in the audit’s second week. Included with the Audit; quoted separately for multi-phase programmes.
  • Build2 to 8 weeks. From $2,500 one-time; most builds $5,000 to $15,000.
  • Run60 days of hypercare, then monthly. Hypercare included; care plans from $1,000/month.

Questions

What people ask about hardening your app.

Will you tell me to rebuild and then sell me the rebuild?

Plenty of vibe-coded apps are fine for their stage and the report says so. When a rebuild is needed, the report says which part and why, with a price, and you can take it anywhere.

Which builders do you cover?

Lovable, Bolt, v0, Cursor, Replit, Windsurf and Claude Code output, on Supabase, Firebase, Vercel or your own hosting.

What do you need from me?

Read access to the repository, a link to the live app, and thirty minutes to explain what it does and what worries you.

What does the 30-day warranty cover?

Anything we touched: if a fix we made breaks or a finding we marked resolved reappears within 30 days, we fix it at no cost. It does not cover new features or changes your team makes afterwards.

How and when do we pay?

Fixed-price work is invoiced in milestones: a deposit at kick-off, the balance at acceptance. Care plans are monthly in advance and cancel at any month end. Platform and model costs pass through at cost and are itemised.

Reading

Also what we do

Related: Build, Run, Advise

Harden

Talk to the people who would build it.

Thirty minutes. Bring the work your team still does by hand. You leave with a yes or no on fit and the first thing we would build.

Book the call
A team of six gathered around one screen in an open-plan office
Thirty minutes with the people who own the process. Photo: Vitaly Gariev, Unsplash.