Rescue audit for vibe-coded apps
Triage for your AI-built app.
It worked with five users. At five hundred something broke, and nobody can tell you why. I read your Lovable, Bolt, Replit or Cursor app end to end, then send you every real problem ranked, with a fixed price to fix each one. In 48 hours.
Fixed price, paid upfront. Price: $PRICE.
What usually breaks
Same four places show up in almost every app that an AI wrote fast.
-
Auth and permissions
Signed-in users can read other people's rows. Admin checks live in the frontend, where anyone can edit them.
-
Payments and webhooks
Stripe events arrive twice, arrive unsigned, or never update the account. Money and state drift apart.
-
Database and policies
Row level security is off, or on with a policy that says
true. Service keys sit in the client bundle. -
Deploy and cost
Secrets in the repo. Staging pointed at production. A function that loops and burns your usage in a night.
How it works
-
01
You send the app
Repository access and a staging URL. Two paragraphs on what is failing. No production credentials, no customer data.
-
02
I read all of it
Every route, query, policy and integration. I run it, break it, and check the paths that cost money or leak data.
-
03
You get the triage
Findings ranked by severity with file and line. A fixed price per fix. A plan that says what to do first, and what to ignore.
The report format
A sample, so you know what lands in your inbox. No client names, no invented results.
profiles readable by any signed-in user
Critical
Fixed price
In the 48 hours you get
- Every finding, ranked by severity, with the file and line.
- Why it matters, in plain words, and what it breaks at scale.
- A fixed price for each fix, and one total if you want them all.
- A short plan: what to fix this week, what can wait.
Who reads your code
I'm Gustavo Costa. Tech Anchor at Thoughtworks, writing software since 2017, mostly TypeScript, Node, React and mobile. I have spent years opening codebases that other people left in a hurry.
I use the same AI tools you do. That is why I know where they cut corners, and why "it works on my machine" is not a diagnosis.
Price
$PRICE flat
Paid upfront. You get the full report whether or not you hire me to do the fixes.
- 48 hours from the moment I have repo access and a staging URL.
- If you hire me to fix the findings, the audit fee goes toward the fix. confirm
- Guarantee: GUARANTEE TERMS
Questions
What if my app was built with something else?
Lovable, Bolt, Replit, Cursor, v0 and plain "I asked ChatGPT and pasted it" all work. If it runs JavaScript or TypeScript, I can read it.
Do you fix it too, or only report?
The audit is the report. Fixes are a separate job, priced per finding before I start. You can take the report to your own developer instead.
Do you need production access or my customer data?
No. Repository access and a staging URL are enough. If a problem only shows in production, we reproduce it with test accounts.
What about Supabase, Firebase, Stripe, Clerk?
Covered. Most critical findings in AI-built apps live in exactly those integrations: policies, webhooks, keys in the bundle.
Is this a full penetration test?
No, and I say so in the report. This is a code and architecture audit. If you need a formal pentest for a client or an insurer, I will tell you to hire one.
How many audits do you take?
AUDITS PER WEEK at a time, so the 48 hours holds.
Request an audit
Tell me what is failing. I answer within one business day, with a yes or a no. If I can't help, I'll say so and point you somewhere useful.
Or email me directly: CONTACT_EMAIL