Built in a weekend.
Ready for real users?
Lovable, Bolt, v0, Replit, Cursor, Claude Code, ChatGPT or Grok get you a working app fast. Whether it is secure and holds up in production is a different question. I check it and, if you want, make it production ready. Fixed price.
A look under the hood.
Layer by layer.
Auth and permissions, database policies, exposed keys and secrets, input validation, dependencies, cost, GDPR and code structure. From €990.
One traffic light
per area.
You get a clear report in your client area: what is critical, what can wait, what is fine. With concrete recommendations you can implement yourself, with your team or with your AI tools. Or with me, at a fixed price.
Gaps closed.
No rewrite.
Critical gaps first. Then tests, CI/CD, monitoring, error tracking and backups. As long as the foundation holds, your app stays your app.
Ready for real users.
Documented. Handed over.
Secure, monitored, maintainable. With documentation and a handover, so you or your team can keep building.
Fast to build. Easy to get wrong.
AI tools write code that works. Rarely code that is secure by default. You cannot see the gaps from the outside. These three are typical:
- Any signed-in user can read everyone else's data. Often a browser is all it takes.
- Your API key sits in the page's code for anyone to see. Someone else uses it, and you get the bill.
- Forms and endpoints accept whatever comes in. Anyone who knows how can write whatever they like into your database.
Most founders only notice once it has happened. The check finds the gaps first. Before your users do, or your next invoice from the API provider.
Eight areas. One report.
Authentication & permissions
Who can log in, and who can see and change what.
Database policies
Row Level Security in Supabase and the equivalent rules elsewhere.
API keys & secrets
Nothing that belongs on the server ends up in the browser.
Input validation
Every form and endpoint checks what comes in.
Dependencies
Known vulnerabilities and outdated packages.
Cost & abuse
Limits and quotas, so nobody runs up your bill.
GDPR basics
Where data is stored, what gets logged, what is missing.
Code structure & maintainability
Whether your app can keep growing, or whether every change breaks something else.
Check first. Then fix, at a fixed price.
- 01 / Security & code check
From €990
€990–2,200 · Report in 5 business days
All eight areas, a report with one traffic light per area and a fixed price for production readiness. Includes a 30-minute review call. Half the fee is credited when you book it. Also available on its own, with no follow-up order.
View sample report → - 02 / Production readiness
Fixed price
€6,000–22,000 · 2–6 weeks
Critical gaps closed, tests and CI/CD, monitoring and error tracking, backups, performance, accessibility, documentation and handover.
- 03 / Maintenance
Optional
from €1,000 per month
Fixed monthly price with 10 hours for updates, monitoring and small features. Response within one business day.
Every offer includes a data protection concept. GDPR compliant, hosted in the EU.
All offers compared →Hiring a freelancer. Without the usual risks.
The typical concerns about freelancers. Answered before you ask.
Quality
- At most two client projects at a time.
- Acceptance criteria in every offer.
- A preview per feature.
- CI with automated tests.
- A demo every one to two weeks.
Proof30 days of free bug fixes after acceptance. Professional liability insurance (exali).
Availability
- A fixed backup developer from my network who knows the stack and the project.
- Payment by milestone.
- You never pay ahead of the current one.
ProofSubstitution clause in the contract, milestone plan in the offer, response within one business day in maintenance.
Knowledge
- Code, repos, hosting and domain accounts are yours from day one.
- A standard stack: Next.js and TypeScript.
- Documentation as a fixed deliverable: README, architecture overview, decision log, runbook.
ProofHandover session and a recorded code walkthrough, included in the fixed price.
Good questions. Straight answers.
Process & price
How does the check work?
You send a request and briefly describe your app. I get back to you within one business day with the fixed price. After payment you give me access, and I usually start within a week. Five business days later the report is in your client area, and we go through it in a 30-minute call. If you want, you also get the offer for production readiness. The check is a separate order, production readiness an offer and not an obligation.
What does the check cost, and what do I get?
Between €990 and €2,200, depending on the size and complexity of the app. I give you the exact fixed price after a short description of your app, before you order. You get a review of all eight areas and a report with one traffic light per area, within five business days of access to the code. The report sits in your client area, with its own login, and can be exported as PDF or HTML. We go through it in a 30-minute call. Plus a fixed price for production readiness. If you book it, half the check fee is credited.
When do I pay what?
The check on order. Production readiness by milestone: each one half at the start and half after acceptance, for which you have five business days. Half the check fee is credited on the first invoice.
The check
Which tools do you check apps from?
Lovable, Bolt, v0, Replit, Cursor, Claude Code, ChatGPT and Grok, typically with Supabase or Firebase behind them. I review web apps. Native mobile apps, for example from FlutterFlow, Expo or React Native, are not included at the moment. Web apps from other tools are welcome too. Just say what yours is built with in the request.
Isn't an automated scanner enough?
As a start, it beats nothing. A scanner finds missing rules, for example whether row level security is on. It does not check whether the rules do the right thing: whether customer A can see customer B's data, whether the business logic holds, where your API bill can blow up. I check that by hand.
Is the check a penetration test or legal advice?
No. I review code and configuration, I do not attack your app from the outside. That finds the typical gaps in AI-built apps, but it is no guarantee that there are no others. On data protection I check the technical basics from practice. For a binding legal assessment, please talk to a lawyer.
Access & data
What access do you need?
Read access to the code and the backend. Lovable, Bolt and co. can connect to GitHub: you invite me to the repository there, and to Supabase or Firebase as a member with as few rights as possible. I show you how.
Do you see my users' data?
As little as possible. I review a copy without real data, or with read access to the configuration. Where real data is visible, a data processing agreement applies, and everything stays confidential.
After the check
I fix the findings myself. Do you check again afterwards?
Yes. The re-check costs half the check fee. I review every finding from the report again, and the traffic light in your client area is updated.
Will you rewrite my app?
No, as long as the foundation holds. Production readiness closes the gaps and adds what is missing. Your app stays your app. If the foundation does not hold, the report says so with reasons, and you decide how to proceed.
How long does production readiness take?
Usually two to six weeks, depending on what the check finds.
Know where you stand.
Before your users find out.
Start with the check. A fixed price, a clear report, and you decide what happens next.