You prompted your way to a working product with Cursor, Lovable, Bolt, v0 or Replit. It got users. Now it falls over under load, a customer can see another customer's data, or every change breaks two other things. We take over AI-generated codebases, fix what matters in order of risk, and hand back a system that runs unattended.
Fixed-price audit first · No obligation to continue · Reply within one business day
AI coding tools are very good at producing something that works when one person clicks through it. They are consistently bad at the properties that only matter later: what happens with a thousand rows instead of ten, what happens when two users act at once, what happens when someone sends input the prompt never imagined, and what happens at three in the morning when nobody is watching.
None of that is a reason to regret the approach. You validated an idea for a fraction of what an agency would have charged. It just means the second half of the work still has to be done, and the tool that did the first half cannot do it.
We have taken over enough of these to know where to look first.
Next.js or React frontends wired straight to Supabase or Firebase. Typical findings: row-level security disabled or written as true, service-role key in the client, server actions without auth checks, storage buckets public by default, no rate limiting on auth endpoints.
Python or Node backends that grew inside one file. Typical findings: secrets in the repository history, SQLite in production, no process supervision, an admin panel reachable without login, and a deployment that stops when the tab closes.
Real backends in Go, Node, Python or Java, often architecturally reasonable. Typical findings: the same logic implemented three slightly different ways, authorisation checks present on some handlers and forgotten on others, shell commands built from user input, and 90% test coverage of things that don't matter.
We never start by rewriting. We start by reading. The audit is fixed-price, takes days not weeks, and produces a document you can act on with or without us. Then we fix in the order that protects your users and your revenue, not the order that is most interesting to engineers.
It is not a rewrite by default. Rewrites are how a two-month problem becomes a nine-month problem. We recommend one only when the foundation genuinely cannot carry the product, and we will show you why in the audit.
It is not a lecture about how you should have done it. You shipped something and found customers. That is more than most teams manage. Our job is the second half.
It is not a black box. Every finding has a file and line number. Every fix is a reviewed pull request in your repository. You can stop after the audit and take the report to anyone else.
It is not a scanner report. Automated tools find some things. Reading the code finds the authorisation bug that lets user A export user B's invoices. That one is never in the scanner output.
A vibe-coded app is software produced mostly by prompting an AI coding tool such as Cursor, Claude Code, Lovable, Bolt, v0 or Replit, accepting what it generates, and iterating until the demo works. It is a fast way to get a working prototype. The problems appear when real users, real data and real attackers arrive, because the generated code was optimised for looking right in a demo, not for running unattended in production.
A rescue engineer is a senior developer who takes over a codebase that is failing, unfinished or unmaintainable, usually after the original team or tool that produced it is gone, and brings it to a state where it runs reliably in production and can be maintained by a normal team. The work covers stabilisation, security fixes, architecture corrections, tests, deployment and documentation.
In most cases, yes. A full rewrite is the most expensive and riskiest option. Most AI-generated apps have a workable core surrounded by security holes, missing error handling, no tests and fragile deployment. We fix those in place and replace only the parts that genuinely cannot be salvaged.
The audit is fixed-price and takes three to seven days depending on codebase size. It produces a ranked list of problems with an effort estimate for each, so you know the cost of the fix before committing. Most rescues then run from two weeks to two months on time and materials or a fixed scope.
Apps built with Cursor, Claude Code, GitHub Copilot, Lovable, Bolt, v0, Replit and similar. The stacks these produce are usually Next.js or React with Node, Python or Supabase backends, sometimes Go. We also work in Java, Spring Boot, Vue, PostgreSQL, MongoDB, Kafka, and Kubernetes on GCP, AWS or Azure.
Yes. All work happens in your repositories and your cloud accounts. Everything we produce is yours. At handover you receive documentation, runbooks and a walkthrough so your next engineer, or we on a retainer, can operate it.
What the app does, which tool built it, what goes wrong and when you need it fixed. An engineer replies within one business day with next steps and a price for the audit.
NDA on request · Read-only access is enough for the audit