I take vibe-coded MVPs — Lovable, Cursor, Bolt, Replit, Claude — and close the gap between "demos well" and "safe in production." The catch: the AI that wrote the bug can't be trusted to find it. In one real app, the commit literally titled "Protect PII" was the breach.
Fully async. No calls, no timezones. You share the repo, I return a written audit and production-ready code — every finding and every change explained in writing, cited at file:line.
You shipped an MVP and got traction — first users, maybe an investor. Now it crashes under load, you're afraid to touch the code because you don't know what depends on what, there are no tests, the secrets are probably in the repo, and a senior hire is slow, expensive and a six-week commitment you can't make this month.
You don't need a rewrite. You need someone senior to make what you already have safe to run in front of real people. That's the only thing I do.
AI code generators ship hardcoded secrets, missing authorization checks, no input validation and zero tests — by default. Here is one, exactly as it was found.
supabase/migrations/0007_profiles_policies.sql — meet-in-person sports app, React · Supabase · Lovable
create policy "profiles_owner_read" on public.profiles for select using ( auth.uid() = id ); -- added in commit 4f2c1ae "Protect PII" create policy "profiles_public_read" on public.profiles for select using ( true ); -- policies on the same table are OR'd, never AND'd. -- the second policy silently re-opened the first. drop policy "profiles_public_read" on public.profiles;
That is the whole job in one screen. Not a scanner dumping 200 warnings — one structural mistake, the line that proves it, and the line that closes it.
Seven critical flaws. Four of five were one query from a breach. One was genuinely solid — and I said so.
The public key let anyone read every user's name, DOB, phone and exact home GPS. A commit titled "Protect PII" was the bug — two policies OR'd back to true.
Any signed-in user could promote themselves to admin — the role sat in a user-writable table and the update policy never pinned it.
Patients could self-escalate to admin, and a default-public policy exposed every patient's raw PII to anyone with the public key.
The customer table was readable, writable and deletable across every tenant with the browser key — and a view leaked all password hashes pre-login.
No critical flaws. A genuinely strong, money-aware server-side design — credited honestly. The one risk: payment integrity rode on a single default-off flag.
Targets anonymized by stack and domain. Full named reports with file:line remediation go privately to each owner, under responsible disclosure. The point isn't that AI code is bad — it's that telling a real flaw from a false alarm is senior judgment, not a scan.
25 years in engineering. Not a junior patching symptoms, and not a scanner dumping 200 findings. I find the one structural weakness, then the line of code that proves it. The five audits above are the résumé.
I use AI agents to move fast across a whole codebase. Every architectural call is still human judgment — that's the part that can't be prompted.
I work from OWASP and rebuild your real authorization model from the database, not the surface. That's how the flaws above were found — and how the false alarms were dismissed.
Every finding and change is explained in prose you can forward to your team or your investor. You keep the knowledge and the documentation, not just a diff.
The repo — read-only is fine — and three short answers about what's breaking.
I audit security, architecture, scalability and test coverage, then send a written P0 / P1 / P2 list cited at file:line. Free, yours to keep.
If you go further: security hardening, critical-path refactors, test coverage, CI/CD and handoff docs.
Confident it holds, with a written record of exactly what changed and why.
Async is the feature, not a limitation. You read deliverables when it suits you, you keep a permanent paper trail you can forward to your team or your investor, and nothing waits on a thirty-minute slot that works across two timezones.
Read-only access. NDA before access if you want one. Never stored beyond the engagement, never shared, never used to train anything.
The teardown is free — you see real findings before paying. If a paid pass surfaces nothing actionable, you don't pay for it.
Want the depth before you send anything? Ask for a redacted sample report — a real audit, one of the five above, with the actual findings.
Most AI-generated stacks: Next.js, React, Node, Python / FastAPI, Supabase, Firebase. If it runs, I can audit it.
Why not cheaper, like a freelancer? Because you're not paying for code — you're paying for the judgment to know which risks actually matter, and the experience to fix them without breaking what works. A cheap rewrite that introduces new bugs costs more than doing it right once.
What's breaking right now?
What happens to the business if it isn't fixed in the next two weeks?
A link to the repo (read-only is fine), or a description of the stack.
If there's a real, urgent problem and you're ready to move, that's everything I need to scope it. If the answers tell me you don't need this yet, I'll say so — I'd rather point you in the right direction than sell you a sprint you don't need. Replies come back in writing, usually same day. Audits run 3–5 days; sprints 1–2 weeks.