Prototype to Production
Prototype to production for Lovable, v0 and Bolt apps. A €99 Prototype Check in 48 hours, then we make your app safe for real users, data and payments.
Your app works in the demo. Now it needs to work for customers.
You described a product to Lovable, v0, Bolt, Replit or Cursor and got something real. It has screens and a login, and it does the job. People you showed it to liked it.
Then you tried to launch it. Getting from prototype to production, from works in the demo to works for paying customers, turned out to be most of the project.
That's normal. These tools are very good at building a version that convinces people, and they take the shortest path to a screen that works. The work that makes software safe to rely on doesn't show in a demo, so it gets skipped. If you built with Lovable, is Lovable safe? covers the public incidents and what its own security scans miss.
What is usually missing
These are the common gaps, and the ones we check first.
Permissions that only exist in the browser. The demo hides the admin button from non-admins, but the endpoint behind it answers anyone who calls it directly. We check this first.
Database rules left wide open. Row-level security is off, or the policy is true, because that was the quickest way to make the prototype work. Every user can read every other user's data. If your app runs on Supabase, our row-level security checklist covers the policies, grants and keys to check.
Secrets in client-side code. API keys and service tokens sent to the browser, where anyone can copy them and use your account.
Queries that only work at demo size. One query per row instead of one per page, no indexes, and lists that fetch the whole table and filter it in JavaScript. Fine at ten records. Unusable at ten thousand.
No migrations. The database is in whatever state the last prompt left it. You can't change it without risking the data, and you can't be sure what production looks like.
Error handling that assumes success. A payment fails, an upload times out or another service returns an error, and the app either shows the wrong thing or hangs. The demo never failed, so these paths were never tested.
No tests and no pipeline. Every change is a gamble. This is why progress stalls about three weeks after launch: each fix can break something else, and nothing catches it.
Prototype Check
€99, within 48 hours. Before you commit to a rescue, someone on our team goes through your repository and live app and writes up the most serious security and data risks: who can read what, which keys are exposed, and what happens to payments and personal data. Then we walk you through it on a 15-minute call.
- What to send: the repository (read access is enough), the live URL, and which tool built it
- What you get: a short written list of the top risks, ranked by how much each could cost you
- The fee: €99, paid by a link we email you after you request it, and credited in full against the build if you then hire us
- To start: fill in the Prototype Check form. We reply within one business day
The fee means every request gets a real person's attention. If the check shows your app needs more than a few fixes, the next step is the full five-day audit below.
How we work
Check, then a fixed-scope audit. After the Prototype Check, the full audit takes five days. You get a written report on what's there: the sound parts, the demo-only parts, the security holes, and what each fix costs. We don't write code yet. If you take that report and hire someone cheaper, it has still done its job.
Security and data first. We move permissions to the server, write and test the database rules, and take secrets out of the browser. This comes first because every day of real traffic on an open database is exposure you can't take back.
Then load, tests and the deploy. In that order, because each step depends on the one before.
We keep what's worth keeping. Usually that's most of the interface and much of the product logic. It's real work, and rewriting it just to tidy it would waste your money. What tends to get replaced is the layer underneath: data access, logins and anything that touches money.
What to expect from us
We'll tell you what we find, even when it's worse than you hoped. We'll tell you when a rewrite is cheaper than a rescue. And we'll hand the app back documented, so you can keep us or not, as you choose.
We've built MVPs, web and mobile apps, and AI features since 2021. We started this service because we kept meeting founders who had built something promising with AI tools and needed it to become real software.
If that's you, start with the €99 Prototype Check. Tell us about your app, and within 48 hours you'll know where you stand.
By tool
What usually needs fixing, tool by tool: Lovable, Bolt, v0 and Replit apps.
How it works
- A five-day audit before we write code
- We read the whole codebase, run it with realistic data and try to break it the way a real user or an attacker would. You get a written report: which parts are sound, which features only work in a demo, where data can leak, and what each fix would take. It's a fixed scope, and it's useful even if you hire someone else afterwards. You stop guessing about your own product.
- Close the security gaps
- This is the first thing to check and the most expensive to ignore. AI-built apps often check permissions in the browser instead of on the server, leave database rules open because that made the demo work, and put API keys in client-side code where anyone can read them. None of this shows in a demo. All of it becomes a breach in your first week with real users. We close each gap and show you the before and after.
- Make it handle real traffic
- Prototypes are built against ten rows and fall over at ten thousand. We fix queries that run once per item, add the indexes your data now needs, paginate lists that fetch everything, and move slow work out of the request. Then we load-test it, so the numbers we give you are measured.
- Migrations, so your data is safe
- You can reset a demo when the schema changes. You can't reset a product. We put your database under version-controlled migrations, set up backups and restore from one with you watching, and separate staging from production so a mistake isn't permanent.
- Tests on what matters
- We don't chase a coverage number. We test the paths that cost you money if they break: sign-up, payment, and the two or three actions your product exists for. A pipeline runs those tests on every change and blocks the deploy if they fail. You should be able to ship on a Friday.
- You run it, or we do
- We can hand it back with the documentation your team needs to own it, or keep running it for you each month. We'll tell you which we think fits. Either way, you won't end up depending on us by accident.
- When it's better to start again
- Sometimes it is. If rewriting a component, or occasionally the whole app, is the fastest route to something you can build on, the audit says so. You get the reasoning and the cost before you spend anything on fixing the wrong foundation.
What's included
Included
- A five-day audit with a written, prioritised report
- Permissions moved to the server and tested
- Database rules written, tested, and shown to you before and after
- Secrets removed from client code, and rotated where they were exposed
- Load testing, with measured numbers
- Version-controlled migrations, backups and a staging environment
- Tests on sign-up, payment and your two or three core actions, plus CI
Not included
- New features (we quote these separately after the audit)
- Redesign, unless the audit finds the interface is the problem
- Ongoing hosting and third-party service costs
- Building on in the AI tool afterwards, which we'd advise against
What we build with
- Next.js
- React
- TypeScript
- PostgreSQL
- Supabase
- Stripe
- Playwright
- Docker
What is the €99 Prototype Check?
What does the audit cost, and what do I get?
What is usually wrong with an AI-built app?
How long does hardening take?
Will you throw away my code?
What if a rewrite really is cheaper?
Which tools do you work with?
Tell us about your project.
Get in touch ↗