Clients
Kevin, Los Angeles · “the flexibility in their expertise was really key to make things work”Dominik, Australia · “a clean, scalable backend that now powers our real estate enquiry responder”Pascal, Austria · “superb knowledge of both Weweb and Xano”Operations lead, Australia · “one of the first holidays EVER where no groups have turned up at the wrong cinema”Kevin, Los Angeles · “the flexibility in their expertise was really key to make things work”Dominik, Australia · “a clean, scalable backend that now powers our real estate enquiry responder”Pascal, Austria · “superb knowledge of both Weweb and Xano”Operations lead, Australia · “one of the first holidays EVER where no groups have turned up at the wrong cinema”
Book a call
Migrations · AI-built apps

An app built with Lovable, Cursor or Claude Code is ready for real users when three things hold: each user can only read and change their own data, the database survives a mistake, and a change can go live without breaking what already works. A short fixed-price review tells you which of the three you have.

These tools get you to a working first version fast, and that's the hard part. What gets skipped is what nobody sees in a demo: security scans of AI-built apps keep finding tables anyone can read and secret keys shipped to the browser. We build with AI agents every day, so we know where to look.

Book a 15-minute call Take the 2-minute test

When it makes sense

  • You're about to let in people you don't know personally, or to take payments
  • It runs on Supabase or Firebase and you're not sure what the access rules say
  • Every new prompt fixes one thing and breaks another
  • API keys or passwords are in the front-end code or in the repository

When it doesn't

  • It's a prototype to show investors or to test an idea with friends
  • Nobody else's data is in it yet
  • You're planning to start over anyway: then scope the first real version instead

01

A 15-minute call about what you built and who uses it.

02

A short fixed-price review: access rules, data, secrets and deploy. You get a written list ordered by risk, security first.

03

We fix what can't wait, in your repository.

04

Then you choose: keep building it yourself, with rules your AI tool follows, or hand us the next part at a fixed price.

These come from how the app was built, not from the tool that wrote it, and the same checks apply to any app.

Tables open to anyone: in Supabase, a table exposed to the API without row-level security can be read by anyone with the app's public key. From October 30, 2026, new tables aren't exposed by default, but existing ones keep their access.

Endpoints that hand back another user's data when someone changes the ID in the request.

Secret keys (AI providers, payments) shipped to the browser, where anyone can copy them.

Missing security headers, the ones browsers use to block common attacks.

From our work

Volantazo, our own app, built in one night with Claude Code.

Gonzalo built the first usable version of Volantazo in one night with Claude Code. That's how we work every day: an AI agent writes the code, a second model reviews it, and a developer reviews both before anything ships. The review we'd run on your app is the one we run on ours.

Volantazo
My searchInvite
Cars 39
SORT Best deal ▾
VOLANTAZO TOYOTA COROLLA 2019
$18,500
53,000 MI · 4 MI AWAY
Viewing bookedGood dealTime set
↳ 12% below fair price
VOLANTAZO VW GOLF 2017
$16,900
63,000 MI · 9 MI AWAY
Waiting for replyFair price
↳ Ask if it's been in a crash
VOLANTAZO FORD FOCUS 2018
$15,200
46,000 MI · 6 MI AWAY
To contactOverpriced
↳ 9% above fair price
CarsRouteAsk

Do I have to rebuild it?

Usually not. Most of what you built is fine. The review tells you what to fix, in what order and at what cost, before you commit to anything else.

What do you check?

Who can read and change each piece of data, where the secrets live, how the database changes, how a change reaches production and whether the app can be restored if something goes wrong. Security comes first because it's the one thing that can't wait.

Which tools do you work with?

Claude Code and Cursor, and Supabase and Firebase on the backend.

Can I keep building it myself afterwards?

Yes. We can leave instructions your AI tool follows, a branch of your own and rules that stop anything from going straight to production. One of our clients already works that way.

How much is the review?

A fixed price we share on the call, once we know the size of the app. It's short on purpose: the point is to know what you have before you spend more.

Other migrations

Fifteen minutes on a call. If it's not a fit, we'll say so and point you somewhere better if we can.

Book a 15-minute call
SectionHome
Book a call