01
Audit & triage
Before anything is fixed, we look at what is there: code, architecture, dependencies, data model, and operations. You receive a prioritized findings report and an honest recommendation on whether cleaning up pays off or whether rebuilding parts or the whole would be cheaper.
Typical findings and tasks
- No overview of how the parts of the app fit together and where the biggest risks are
- Outdated or unsafe dependencies that nobody chose on purpose
- Duplicated logic and code that no feature uses anymore
- A data model that no longer matches what the app does today
Example: a booking app built with an AI tool is reviewed. The audit shows that sign-in and database are sound but the payment logic should be rebuilt, and delivers an order of work with an effort estimate per building block.
Audit & triageSheet 1/4
02
Security hardening
An AI builds features that work in the test. Whether the rules about who may do what hold across the whole app is often something nobody checks. We examine your app from an attacker's point of view and close the gaps: permissions across all functions, the handling of credentials and third-party services, and protection against misuse and runaway costs.
Typical findings and tasks
- Permissions that are right in single functions but not across the whole app
- Data access rules that were never put to the test in the demo
- Credentials and keys in places where they should not be
- Functions and services that anyone can call as often as they like, at your expense
- Third-party building blocks that nobody chose or checked on purpose
Example: in a Next.js app with Supabase, the data access rules are redrawn and tested with two test accounts, a key embedded in client code is replaced and rotated, and expensive calls to external services get limits.
1// api/config.ts
2
const API_KEY = "sk-live-…";
const API_KEY = process.env.API_KEY;
Finding 1 · Secret in code
3app.get("/user", async (req, res) => {
4
db.users.find(req.query.id)
db.users.find(session.userId)
Finding 2 · Access
5});
2 of 2 findings resolved
Security hardeningSheet 2/4
03
Stabilization & refactoring
When every change breaks something else, the code itself lacks a safety net. We fix bugs, remove duplicated and dead code, bring order to structure and data model, and add tests and an automatic check on every change, so the app can be changed safely again.
Typical findings and tasks
- No automated tests for sign-in, payment, or the core feature
- Errors that disappear silently instead of being reported
- The same logic in several places, each slightly different, and no consistent structure
- Tests that are green but check nothing that matters
Example: the three most critical flows of a web app get automated tests, then the duplicated discount logic is merged into one place and a check is set up on every commit.
Stabilization & refactoringSheet 3/4
04
Production readiness & operations
An app that runs on a laptop is not a product yet. We set up deployment, separate environments, monitoring, backups, and performance so that you notice an outage before a customer reports it, and know what hosting and AI services will cost.
Typical findings and tasks
- Test and live environments are not separated
- No backups, or a restore that was never tried
- No monitoring: outages only surface through customer complaints
- Unclear hosting and AI-service costs as usage grows
- Unclear what AI tools and AI services may do with your data and access
Example: an app on Vercel and Supabase gets separate staging and production environments, automatic backups with a rehearsed restore, an alert on error spikes, and an overview of where data flows to AI providers.
Production readiness & operationsSheet 4/4