Funded startups
Pre-seed and seed teams who shipped the MVP fast, and now have enterprise customers asking questions the MVP cannot answer.
For teams who built it with AI
Your app works.
Now make it survive real users.
We take prototypes built in Cursor, Lovable, Replit, v0, Bolt and Claude Code and turn them into software you can safely charge money for: hardened, tested, and editable by a human again.
- Typical engagement: 1–6 weeks
- Fixed scope, fixed price
- Senior engineers only, no handoffs
- US-based, US hours
Sound familiar?
Every AI-built app we see arrives with some combination of these. None of them are your fault, AI doesn't always account for everything to be production grade.
Hover or tap the underlined terms if any of them are new to you.
- “A customer sent us a security questionnaire and we cannot answer half of it.”
- “We are about to start taking payments, and nobody has checked whether that is safe.”
- “Someone on the board asked if the app is secure. I did not have an answer nor know how to give an answer.”
- “It works fine until two people use it at once.”
- “The API keysThe secret passwords your app uses to talk to other services, like your payment processor or your database. Anyone holding them can act as you, and run up your bill doing it. are in the frontendThe part of your app that runs inside the visitor’s own browser. Anything put there can be read by anyone who opens developer tools, so secrets do not belong in it..”
- “Row-level securityThe database rule that decides which rows each user is allowed to see. With it switched off, any logged-in customer can read every other customer’s data. Supabase ships with it off until you turn it on. is off, so the database is wide open.”
- “Every new feature breaks an older one.”
- “There are no testsSmall automated checks that run your app and confirm it still does what it is supposed to. Without them, the only way to find out you broke something is a customer telling you., so nobody knows what is safe to change.”
- “The AI cannot fix it any more. It just rewrites the file.”
- “Signups work, but I have no idea what happens when a payment fails.”
- “I am scared to deployPushing your newest code out to the live site your customers actually use. It should be boring and reversible. Usually it is neither. on a Friday. Or a Tuesday.”
Who we work with
The code looks the same whoever wrote it. What differs is who is asking you to prove it is safe, and how soon.
Small businesses
Companies running on an internal tool somebody on staff built. It works, nobody planned for it to be load-bearing, and now the business depends on it.
Government & regulated
Organizations where a data leak is a public problem, not just an embarrassing one. All work is performed in the United States by the two named engineers. We have found and reported vulnerabilities in software this sector runs on.
Solo founders
One person, one app, real users. Fixed-scope work sized so that fixing it does not consume your entire runway.
What we do
Four services. Most engagements start with the first and pick up the others as the code tells us what it needs.
Production hardening
The gap between a working demo/MVP and something you can safely put a login screen on. Auth and session handling, access control and RLS policies, secrets out of the client, input validation, rate limitingA cap on how often one person or script can hit your app. Without it, someone can hammer your login page all night, or run up your API bill for you., real error handling and logging.
You get: a prioritized risk list, and the fixes committed, not just the report.
Code & architecture rescue
For codebases that have stopped being editable. We untangle generated duplication, fix the data model underneath it, draw the boundaries that were never drawn, and put a real test suite and CIContinuous integration. A robot that runs your tests automatically every time the code changes, so a mistake is caught in minutes instead of by a customer. around the parts that matter.
You get: a codebase where changing one thing changes one thing.
Scale & performance
For apps that found users faster than they found engineering. Query and index tuning, N+1 eliminationA common performance bug where showing a list of 100 things quietly makes 101 separate database trips instead of one. Invisible with test data, crippling with real users., caching, background jobs, a deploy pipeline that rolls back, plus monitoring and alerts so you hear about problems before your customers do.
You get: measured before-and-after numbers, and a dashboard that tells the truth.
Feature delivery
Hand us the three tickets the AI keeps failing on: the billing edge cases, the multi-tenantOne application serving many separate customers at once, where each must only ever be able to see their own data. permissions, the migration, the integration with the API that has bad docs. We build them properly, in your repo, in your style.
You get: shipped features, in reviewable pull requestsA proposed change to the code, shown side by side with what it replaces, that gets reviewed before it goes anywhere near your live site. you can actually read.
Security work on the record
Anyone can say they take security seriously. We have found and reported real vulnerabilities in shipping software, through CERT/CCThe CERT Coordination Center at Carnegie Mellon University. It verifies reported security flaws and publishes them once the vendor has a fix, which is why these are checkable rather than just claimed. at Carnegie Mellon. The same review that found these is what we point at your codebase.
Plaintext database credentials
A CVECommon Vulnerabilities and Exposures. A public, numbered record of one specific security flaw in one specific product, so everybody refers to the same problem by the same name. is a public record of a specific security flaw.
Municipal accounting software stored its SQL Server connection string in a plaintext config file next to the executable. In the standard deployment that folder sits on a shared network drive on the database server itself, so anyone with read access could recover the credentials.
CERT/CC VU#706118Unauthenticated database backup
The File menu was reachable from the login screen, and it offered a database backup. Anyone who could open the application could export the entire database, unencrypted, without ever signing in.
CERT/CC VU#706118Starbase
A secure, enterprise-ready .NET API template built on Clean Architecture. Authentication, MFA, audit logging and multi-tenant patterns wired up correctly from the first commit, so the boring security work is done before you write a line of your own.
View on GitHubReported by James Harrold and credited in the CERT/CC advisory, published 19 August 2025.
How it works
-
Teardown: free, 30 minutes
You show us the app and the repo. We tell you, live, what would break first and what it would cost to stop it. You keep the written summary whether or not we work together.
-
Plan and fixed quote
A short written scope: what gets fixed, in what order, by when, for how much. No hourly meter, no open-ended retainer.
-
The work, in the open
We work in your repository on branches, in small pull requests with plain-English descriptions. You see progress daily, not at the end.
-
Handover that sticks
Docs, a deployment runbookA short written guide to the routine operations: how to deploy, how to roll back, and what to do at 2am when something breaks., and guardrails your AI tools respect: tests, types, CI checks and rules files. The next hundred generated commits stay inside the lines.
Engagements
Four ways in, sized so there is one that fits whether you are one person with a side project or an organization with a compliance deadline. All fixed-scope, all quoted before anything starts.
Teardown
Free
- Live review of the app and repo
- Top risks, ranked by what bites first
- Written summary, yours to keep
- No deck, no obligation
Launch readiness review
$1,500
- Focused review before you go live
- Written report you can show a customer
- Top three fixes implemented
- Sized to not eat your runway
Audit & harden
from $6,000
- Full security and architecture review
- Critical fixes implemented, not just listed
- Tests and CI on the paths that matter
- Deployment runbook and handover call
Embedded
from $7,500/mo
- Ongoing feature delivery in your repo
- Code review on your AI-generated pull requests
- On call for the things that break
- Direct line, same-day answers
Government, regulated and multi-team work is quoted individually after the teardown. Prices are for the whole engagement, not per person, and are fixed before we start.
Questions people actually ask
Who actually does the work?
The two of us, in the United States, on US hours. No account manager in between, no offshore team you never speak to, and nobody rotating onto your project halfway through. The engineer who reviews your code on the teardown call is the engineer who fixes it.
That matters more here than on a normal build. Rescue work is diagnostic, so it needs same-day back and forth rather than a question and a next-morning answer. And it means handing someone repository access and often production data, which is a decision worth knowing exactly who is on the other end of.
Are you going to tell me to rewrite the whole thing?
Doubtful. Vibe coding is good for MVP and prototypes and gets you a good amount of the way there. Your app already encodes months of decisions about what your customers want, and that is the valuable part. We fix what is dangerous and straighten what is tangled.
Do I have to stop building with AI?
No. AI is likely here to stay. AI coding tools are excellent on a well-structured codebase with a test suite to check their work, and genuinely dangerous without one. Part of every engagement is leaving behind the guardrails that make your next AI-assisted change safe.
Which stacks do you work with?
Whatever your tool generated. In practice that means TypeScript, React and Next.js on the front end; Node, Python and C# on the back; Postgres, Supabase, SQL Server and Firebase for data; and Vercel, Netlify, Azure, AWS, Fly or Railway for hosting. We have worked in apps built with Cursor, Claude Code, Lovable, Replit, v0, Bolt and GitHub Copilot.
If your stack is not on that list, ask anyway. A missing authorization check looks the same in every language, and the review is the same review.
Is .NET really part of this?
Yes, and it is where we are deepest. We maintain Starbase, an open-source .NET API template with authentication, MFA and audit logging built in, and the vulnerabilities we reported to CERT/CC were in a SQL Server application. If you are building line-of-business software with Copilot rather than a startup MVP with Lovable, you are still in the right place.
Will you make me feel stupid about my code?
No. Maybe you built a working product without an engineering team, which is more than most people manage. Or maybe you have a team that's overleveraged. We have never seen a generated codebase that surprised us, and we are not keeping score.
Can you work alongside my existing developer?
Yes, and it is often the best value. We do the review and hardening pass, they keep shipping features with a clearer map to work from.
Are you insured?
Yes. We carry professional liability (errors and omissions), cyber liability and general liability insurance. A certificate of insurance is available on request, and we will complete your vendor onboarding paperwork before the engagement starts rather than halfway through it.
What do you need to get started?
Read access to the repository, a running environment we can poke at (staging is fine), and 30 minutes of your time. Happy to sign an NDA first.
Book a teardown
Two ways to start. Grab a slot if you would rather talk it through, or send a message if you would rather write it down first. We are US-based, so either way you hear back in your working day.
Pick a time: free, 30 minutes
Straight into our calendar. No forms, no sales sequence.
or send a message
Or email us directly: james@vibecodeprojects.com