Skip to content
Service

Prototype to production.

You built the app. We take it live the way production software is taken live: checked end to end before anyone depends on it.

For founders whose AI-built prototype is about to meet real users, a paying customer or an investor. It starts with a written audit, quoted up front. From there, the same team fixes what it found and keeps building, all the way to a product you can stand behind.

Book a 30-minute call See what we check
One path: prototype, production, and on from there
From prototype to production, and on Your prototype as it is, then the audit in one to two weeks, then the fixes in sprints with the critical items first, then new features in the same sprints, then maintained on agreed terms. Your prototype as it is today, working, untested 1 to 2 weeks Audit the checklist, the verdict, the report sprints Fix critical first, then down the list same sprints Build on new features, quoted before each starts after launch Maintain on terms agreed before launch Same team, same checks, all the way What the audit looked for is what the build isheld to. Nothing is handed off.

Ask your AI if your app is secure. Watch what it says.

It says yes. It almost always does, the first time. Ask again the right way, and it can genuinely find something real. Most people don't ask twice, because working is a standard the app already meets. Production is a different standard.

Not because they're careless. There's no alarm telling you to keep going, and you don't find out which question mattered until it's the one nobody asked. The audit is that full list, asked in order, with the evidence written down.

The questions are here.

The "it works" iceberg: what a demo shows, and what production depends on
The iceberg: a small demo above the waterline, production below Above the waterline, a small tip: the screens, the login, the demo that works, the happy path. Below it, a much larger mass: who can see whose data, where the keys live, what a retry does to a payment, backups that restore, a limit on AI spend, what bad input does, dev kept apart from live, alerts when it breaks, the rules for your industry, packages the AI pulled in, behaviour under load, whether someone else can maintain it, whether it can leave its hosting. waterline roughly to scale the login the screens the demo works the happy path who can see whose data where the keys live what a retry does to a payment backups that restore a limit on AI spend what bad input does dev kept apart from live alerts when it breaks rules for your industry packages the AI pulled in behaves under load can someone else maintain it can it leave its hosting

Who this is for

  • 01

    You shipped fast, with AI

    Lovable, Bolt, Cursor or Replit got you to a working app in days, and now real users, a pilot, or a funding conversation are riding on it.

  • 02

    You don't know what's underneath

    It works when you click through it. Nobody, including you, has checked what happens when someone tries to break it instead.

  • 03

    Someone else is about to ask

    An investor, a first paying customer, or a due-diligence checklist is about to ask who's checked this. Better to already know the answer.

The numbers on AI-written code

Independent researchers have been measuring the gap between sounding right and being right since these tools went mainstream.

What the research measured
  1. 45%

    of AI-generated code samples introduced a known OWASP Top 10 vulnerability, tested across more than 100 models.

    Veracode, 2026 GenAI Code Security Report
  2. 89%

    of builders using AI coding tools report spending real time correcting what it produced, after it told them the work was done.

    DEV Community, 2026
  3. 6×

    the rise in newly logged AI-linked security vulnerabilities in the first quarter of 2026 alone. Researchers believe the real number is higher.

    Cloud Security Alliance, 2026

  4. Confident when wrong

    AI coding models carry their own version of the Dunning-Kruger effect: the least reliable answers arrive with exactly the same confidence as the reliable ones.

    arXiv 2510.05457, 2026
  5. 16 of 18

    CTOs surveyed said AI-generated code had directly caused a production disaster at their company: performance collapses, data corruption, bypassed payment checks.

    Final Round AI, August 2025

Easy to miss, quick to fix

Most of what turns up is not exotic. It is a short list of things that are invisible when you click through the app, obvious the moment someone looks in the right place, and usually a few hours to put right.

  1. 01

    The key to a paid service is sitting in the app itself

    Your AI or maps or email provider key is inside the code the browser downloads. Anyone can copy it and run up your bill.

    Fix   about an hour, plus a new key

  2. 02

    The database answers anyone who asks

    The tool that built the app left the database rules open, so a signed-in user can read every other user's rows with one request.

    Fix   half a day

  3. 03

    It checks that you are logged in, not that it is yours

    Change a number in the address bar and you are editing someone else's order, listing or profile. The most common finding in AI-built apps.

    Fix   half a day to a day

  4. 04

    Nothing stops a script from calling it all night

    The endpoint that talks to a paid AI model accepts unlimited requests. One bored person and you wake up to an invoice.

    Fix   a couple of hours

  5. 05

    A retry charges the card twice

    Payments and webhooks are not built to be repeated safely, so a flaky connection double-charges or double-fulfils an order.

    Fix   half a day

  6. 06

    There is a backup, but nobody has ever restored one

    Backups exist on paper. Whether they can be brought back, and how much would be lost, has never been tried.

    Fix   an afternoon, and a habit

The audit

The same list every time, in priority order, re-sequenced for where your app is headed: an investor review gets security and architecture first, a first big client gets reliability and scale first. Anything already exposed, an API key in the open or a database anyone can read, reaches you the moment we find it, before the report exists.

Three levels, one checklist working days
The three audit levels on a day ruler Triage takes one to two days, Standard about a week, Deep about two weeks. All three run the same checklist to different depths. 246810 Triage 1 to 2 days The business-enders only. Is anything actively on fire. Standard about a week · AED 7,500 The default prototype-to-production audit. Deep about two weeks Due diligence, real scale, or real stakes.
01

Security

  • Exposed API keys and secrets, in source, commits or the client bundle
  • Open database rules: Supabase RLS off, Firebase wide open, service-role keys used client-side
  • Authorization that checks you're logged in, not that you own the record
  • Unvalidated input, injection paths, and no rate limiting on public endpoints
02

Business logic & data

  • Edge cases nobody specified: refunds, timezones, currency rounding, two people editing the same record
  • Schema, indexes and the slow queries that only show up under real load
  • Backups configured, and a restore that's actually been tested
  • Personal data handling and retention, implemented, not just documented
03

Reliability & deployment

  • Error handling with no swallowed exceptions, and alerts when something breaks
  • Idempotent payments and webhooks, so a retry never double-charges
  • Dev, staging and production kept separate, each with its own config and secrets
  • Real tests in CI, repeatable deploys, and a rollback plan that's written down
04

Code, tests & dependencies

  • Type safety, and business rules untangled from UI and data access
  • Tests on the flows that make you money: signup, checkout, the core workflow
  • Hallucinated, abandoned or vulnerable packages the AI pulled in
05

Performance & cost

  • Cost controls first: LLM and API spend caps, alerts before a bill surprises you
  • Unbounded API calls, missing caching and pagination
  • Bundle size and unnecessary client-side weight
06

Handoff & compliance

  • Which rules actually apply to you, researched against your industry, where you operate, and the data passing through your systems
  • Vendor lock-in: can it move off Lovable, Replit or Bolt hosting if it has to
  • A README and architecture notes, so a human can maintain it
  • A dated record of what was reviewed, ready for due diligence

You see everything we checked, not just what we found

The trouble with 'looks fine' is you can't tell it from 'nobody looked.' So every check is written down with one of three outcomes, and the report carries the whole list, not only the problems. It is the standard this page opened with, held to ourselves: no confident answer without the evidence behind it.

Every check ends in one of three states
  • Passed Checked, and it holds.
  • Found Checked, and there is a finding with evidence.
  • Could not verify Logged with what access it would need. Never quietly skipped.

'No finding' and 'didn't look' are never the same thing.

Take the list away with you

The questions above, as a PDF: 34 across seven areas, each with what a bad answer sounds like. Put them to whoever built the app, or to the AI that built it.

It is the part you can ask without access. Most of what an audit examines needs the code and the dashboards in front of somebody, and no list tells you whether the answers coming back are true.

Sending this also puts you on my email list: what audits turn up, and when the course opens. A few times a year at most, and one click stops it for good.

I keep your name and email to send the checklist and to write to you, and delete them after 24 months. Nobody else sees them, ever. Privacy notice.

No list beyond this. Leave whenever you like.

What you get back

One written report, presented on a call and left with you. It leads with the verdict, then the findings, ranked and priced per tier, then the dated record of everything examined. Written so any competent engineer could act on it, not only us. The Standard audit is AED 7,500, and half of it is credited to the first sprint of the fixes.

What a finding looks like
SEC-03 Critical

Editing a listing checks that you are logged in, not that you own it

Evidence
api/listings.ts:142, verified by editing another account's record from a second login
What
Any signed-in user can change or delete any other user's listing by changing the id in the request.
Why it matters
The most common bug in AI-built apps. One curious user, or one bored competitor, and your customers' data is not yours to protect any more.
Fix
Scope every query to the owner and add an ownership check on every write route.
Effort
about half a day
Ranked and priced per tier

  1. Critical

    Fix before real users, real money or a reviewer touch it. These reach you the day they are found.

  2. Should fix

    Real risk, not immediate. Goes into the first sprints.

  3. Can wait

    Worth knowing, safe to defer. Acknowledged in writing so nothing is forgotten.

Done in full on BizBuy

BizBuy, in the work on the home page, went from an AI-built prototype to a live marketplace in about four weeks. The checklist on this page is what that took, and what building with AI every day ourselves keeps teaching us to check.

585 automated tests
11 end-to-end journeys before any release
Read the BizBuy case study
  • Security Login tokens that rotate and detect replay, and rate limiting on every route to shut down abuse before it starts.
  • Privacy & access Personal data is encrypted in the database yet stays searchable, every log line is scrubbed so passports and emails never end up in a logfile, and every query is scoped to its user, so nobody can ever read someone else's data.
  • A twin QA environment A full second copy of the platform, its own site, API and database, where every change proves itself before real users ever see it.
  • Releases without surprises Database changes ship as scripted steps that run automatically before each release goes live. If a step fails, the release does not go out.
  • Reliability Nightly backups streamed to a second cloud provider, watched for staleness, and proven with a restore drill that actually ran.
  • Compliance UAE data-protection retention rules and weekly sanctions-list refreshes, built into the system's schedule instead of someone's calendar.
  • AI kept on a leash Every AI call has a timeout and a fallback, documents are processed under EU data residency, and their contents are never written to a log.
  • Confidence 585 automated tests, plus 11 end-to-end journeys that drive AI-generated fake buyers and sellers through the real verification pipeline before any release.

How it works

Four steps. The level is agreed and quoted on the first call, anything critical reaches you before the report does, and the same team carries on from the fixes to whatever you build next.

  1. First call

    30 min · free · on Google Meet

    You walk us through the product, where it is headed and who is about to look at it. We tell you which level fits and quote it.

    You get   a straight answer on what the app needs, and a quote.

  2. Audit

    1 to 2 days, a week, or two weeks

    Context first, then the checklist at the chosen level. Anything already exposed reaches you the moment we find it.

    You get   the critical findings, the day they are found.

  3. Report

    on a call, then in writing

    The verdict, every finding ranked and priced per tier, and the dated record of what was examined. Yours whatever happens next.

    You get   a report you could hand an investor.

  4. Fix, then build on it

    sprints, quoted before each starts · half the audit fee credited

    Critical items are sprint one, then down the list at the pace you choose. From there it is the same sprints as any build: the features you wanted next, and support once it is live.

    You get   a closed-findings record for the next reviewer, and a product that keeps moving.

Find out where it really stands.

Book a free 30-minute call, or send the repository to [email protected] and we will come back with first impressions.

  • A verdict on where the app stands, in writing
  • Every finding with its evidence, ranked and priced per tier
  • Anything critical the day it is found, before the report exists
  • The dated record of everything checked, including what could not be verified
  • AED 7,500 for the Standard audit, half of it credited to the first sprint of the fixes

Free, and nothing to prepare. Pick a time that suits you.

Jean-Philippe, Founder & lead engineer
Jean-Philippe
Founder & lead engineer · Dubai
Phone / WhatsApp
+971 58 502 0610