Data and access
- Row-level security on every Supabase table, view and storage bucket
- Service and admin keys kept out of the browser
- Sign-up, login, password reset and session handling
Built your MVP with AI? Let’s turn it into a production app.
Lovable, Bolt, v0, Replit and Cursor are a great way to prove an idea. They are much less careful about who can read your database, what happens when a Stripe webhook fails, or whether a second developer can change the code without breaking it.
I’m a fractional CTO with ten years of shipping production systems, most recently on the same stack these tools generate: Next.js, Supabase, Vercel and Stripe. I work the way those tools do, with AI agents doing the heavy lifting while I make the calls. You get the audit in 48 hours, then I either harden what you have in days or move it to a production codebase your team owns, keeping the screens and flows your users already know.
What I check
Payments
- Stripe webhooks verified, idempotent and safe to retry
- Failed payments, refunds and cancellations handled
- What a user can access always matches what they paid for
Secrets and environments
- API keys in the client bundle or the git history
- Preview and production kept apart
- Rate limits on anything that calls a paid API, including your LLM
Reliability
- Error monitoring, and logs you can actually search
- Database backups, and a restore that has been tested
- A way to roll back a bad deploy in minutes
Performance and cost
- Slow queries, missing indexes, and repeated calls that belong in a Redis cache
- AI and hosting spend per user, and where it will spike
- What breaks first at ten times your current traffic
Codebase health
- Whether a developer, or an AI agent, can change it safely
- Tests around the paths that touch money and user data
- Rules and CI checks that stop AI tools reintroducing the same bugs
Packages and pricing
Prices in USDProduction audit
$1,500
Fixed price, report in 48 hours
Where your app stands, and a ranked list of what to fix first.
- Read-only review of your code, database, hosting and payments
- A written report with every issue ranked by risk, opening with a plain-language summary
- A clear call on whether to harden what you have or move to a production codebase
- Each fix written so you can paste it into Cursor or Claude Code, or hand it to a developer
- A 60-minute call to walk through the report
Hardening sprint
Fixed quote after the audit, usually 3 to 5 days
Your app is basically sound. I fix what the audit found and set up the safety net.
- Every high-risk issue from the audit fixed and tested
- CI that runs checks on every pull request
- Error monitoring, backups with a tested restore, and a rollback path
- Handover notes for your team and for your AI tools
MVP to production
Fixed quote after the audit, usually 1 to 3 weeks
Your MVP proved the idea, but it won’t carry the next stage. I move it to a codebase you own and can scale.
- Code in your own GitHub repo, with separate preview and production environments
- Data model, access rules, auth and payments rebuilt properly, with your existing data migrated
- The screens and flows your users already know, kept wherever they work
- Tests and CI on the paths that touch money and user data
- Docs and AI coding rules so your team, or your next hire, can keep building fast
Fractional CTO
Monthly, priced after a call based on scope
Ongoing senior oversight while you keep building fast.
- Review of major changes before they ship
- A weekly call on architecture and priorities
- An AI coding setup your team can keep running
- Help hiring your first engineers when you’re ready
How it works
Step 1
Intro call
Thirty minutes. You show me the app and what’s coming up: a launch, a raise, your first paying users, your first hire. If an audit isn’t worth it yet, I’ll tell you.
Step 2
Access
You give me read-only access to the repo, the database and the hosting dashboard. I’m happy to sign your NDA first.
Step 3
Audit
Within 48 hours of access. AI agents sweep the code, the access rules and the payment flows, and I check every finding by hand, along with how the app actually runs in production.
Step 4
Report and next step
You get the written report and a 60-minute call to go through it. Then fix it yourself with your AI tools, or I send a fixed quote for a hardening sprint or the move to production.
Questions
Who is this for?
Founders and small teams who built an MVP with Lovable, Bolt, v0, Replit, Base44, Cursor, Windsurf or Claude Code and now need it to hold up: real users, real payments, investor due diligence, or a first engineering hire.
Do I have to rebuild from scratch?
Usually not. Most AI-built MVPs have good screens and flows on weak foundations. I keep what works and rebuild what doesn’t, typically the data model, access rules, auth and payments. The audit tells you which parts are which before you commit to anything.
Do I need to be technical?
No. The report opens with a plain-language summary of what’s at risk and what to do first. The technical detail is there for whoever does the fixing, human or AI.
Which stacks do you cover?
The best fit is Next.js or React with Supabase or Postgres, hosted on Vercel, with Stripe for payments. I also cover Node.js, NestJS, Python, Redis, Firebase, AWS and GCP. If yours is different, ask on the call.
Will you change my code?
Not during the audit. Access is read-only, and the fixes come as a list you own. If you want me to make them, that’s a hardening sprint or the move to production.
Can’t I just ask an AI to review it?
You should, and I use AI in my reviews too. It catches a lot of line-level issues. It’s much weaker at seeing how the pieces fit together: a view that skips your access rules, a webhook that trusts the browser, a deploy with no way back. That’s where most of the serious problems are.
Start with a 30-minute call
Usually reply within a dayTell me what you're building and where it's stuck. If I'm not the right fit, I'll tell you on the call. Prefer writing? Email or WhatsApp works too.
Book a 30-min call (opens Google Calendar in a new tab)