Or Bolt. Or Cursor, v0, Replit Agent, Claude Code. The tool doesn't matter — the symptoms are always the same. Users hit bugs you can't reproduce. You're not sure if your database is exposed. You're scared to touch the code.
We're a small engineering practice that fixes that — on a fixed price, in writing, without telling anyone.
02 — symptoms
If two or three of these are true, you don't need another tool. You need someone to look at it.
Your app is live but you're afraid to deploy changes.
You don't know if your Supabase keys are exposed in the client.
Users hit errors you can't reproduce on your laptop.
You need to add a feature but the codebase is a tangle of half-finished refactors.
You're not sure anything is backed up.
You can't tell what's a real bug and what's working as designed.
03 — what you can hire us for
Most engagements start with the audit. The rest is optional, and we'll tell you which parts you actually need.
A fixed-price assessment of your codebase, infrastructure, and deployment. We read every file that matters, run it locally, look at your hosting, and write you a report. You get a prioritized list of issues, what each one would cost to fix, and an honest answer to the question "is this salvageable." The audit is a written report, not a sales pitch — if the verdict is "don't bother fixing it," that's what we'll write.
A defined sprint to fix the critical issues from the audit — security, auth, data integrity, observability, anything actively losing you customers. Scope and price are set in writing before we start. No retainer trap. When the sprint ends, you have a working app and a paper trail of what changed.
Ongoing monthly support for founders who want a senior engineer on call after remediation. On-call for incidents, monthly review of dependencies and logs, small feature work as capacity allows. Optional. Cancel any time with thirty days' notice.
04 — how it works
This is the audit engagement, in order. Remediation and retainer engagements look different and we'll walk you through them on the call.
A 20-minute call. You describe what you've built and what you're worried about. We tell you whether an audit is the right next step.
You give us read-only access to the repo and a deployed staging URL. We send back a one-page engagement letter and an NDA if you want one.
We read the code, run it, exercise the auth flows, look at your database, and check your hosting. Nothing is changed in your account.
You get a written report — typically 10–20 pages — with prioritized findings, fix estimates, and a verdict on what to do next.
A 60-minute walkthrough. We answer questions and decide together whether remediation makes sense. No pressure either way.
05 — what our work looks like
We're new. Instead, here's a real audit we wrote on a deliberately broken Lovable app, so you can see exactly how we work, how we write, and what we catch.
It's the actual artifact you'd receive — not a marketing summary.
“The Supabase service-role key is bundled into the client. Anyone with browser DevTools can read or write any row in your database, including users you haven't authenticated. We confirmed this from a logged-out incognito session.”
06 — about us
We're production engineers — between us, a couple of decades shipping payments infrastructure that moved real money, running on-call rotations for systems that couldn't go down, and cleaning up after launches that did. We're not naming employers here; we'd rather you judge us on the audit you're about to read.
We don't touch your production environment without written sign-off. Code reviews happen on sandboxed forks. NDAs are available on request, signed before any access is granted. All credentials, repo access, and shared documents are revoked within seven days of an engagement ending.
We're a new practice, but not new engineers. Our first clients get founder-level attention and case-study pricing.
07 — questions
08 — get in touch
Twenty minutes, no slides. You describe what you've built and what's worrying you. We tell you whether an audit is the right next step — or whether you don't need us at all. Either way, you'll leave the call with a clearer picture of your codebase than you came in with.