Vibe coding cleanup
Vibe coding cleanup for apps built with AI tools
This is for founders whose app was built fast, with Lovable, Bolt, Cursor or Claude Code, and now has real users, payments or personal data. In three weeks we find what could leak or break, fix the high-severity problems, add a test for each fix, and check the fixes again before handover. It's a fixed price from $8,000: the first week's audit sets the final price, in writing, before any fixing starts.
The work is done by Sachin Mour, who leads engineering at Pulore. He led Emblem's platform as CTO, moved Hexis off hosted Supabase to its own Google Cloud setup, and wrote our security checklist for Lovable apps. You can read a sample report before you book.
What a cleanup fixes
AI-built apps often look finished and leave gaps underneath. These are the gaps we look for first, and what fixing them means:
Database rules
Row level security on every table the API can reach, with policies that check who owns each row, so one customer can't read another's records.
Keys
Secret keys moved out of the browser bundle and the repository, and replaced wherever they leaked.
Server code
Functions and API routes that check who's signed in, and stop trusting IDs the browser sends.
Payments
Payment webhooks verified, and prices set on the server rather than in the browser.
Tests
A test for each fix on the paths that carry sign-ins, payments and customer data, so a later prompt can't quietly undo it.
Deploys and backups
Deploys you can repeat, and a backup that has been restored at least once.
Which of these the three weeks cover depends on what the first week finds. We agree on the list before any fixing starts.
How the three weeks run
Week one: audit
We trace sign-in, payments and customer data from the browser to the database, rank every problem with its evidence and the effort to fix it, and send you the list with a fixed price for weeks two and three.
Weeks two and three: fix and test
We fix the high-severity problems we agreed on, highest risk first, and add a test for each one. You see every change.
Retest and handover
We re-run the audit's checks against the fixed app, then walk you and your developer through what changed and what's left.
Lovable, Bolt, Cursor or Claude Code
The tool matters less than where the data and the rules live. Most apps built this way keep their data in Supabase, where Postgres policies decide who can read and change each row, so that's where we start. The database tests we add follow our pgTAP example, which runs locally and in GitHub Actions.
On Lovable Cloud, we start with viewer access, as in our Lovable security audit, and agree on the kickoff call how fixes reach your project. Apps built with Cursor or Claude Code usually live in a repository you own, and we work there.
See a sample report
Our sample report is what the audit week produces, written for Acme, a demo client portal we built with React, Vite and Supabase. It has 21 ranked findings with evidence, fixes and hours. To show the fixes worked, we reproduced 16 attacks on a local copy: each was refused after the fixes and worked again when we reverted them.
Acme is a demo app we built ourselves, with made-up data.
Price, and who it's for
It's a fixed price from $8,000 for one app, its backend and one cloud account. The first week's audit sets the final price, in writing, before we fix anything.
It's meant for apps where a mistake costs more than the cleanup: real users, payments, personal data, a raise coming up, or an enterprise customer's security questionnaire. If you're still prototyping, start with our free checklist.
A good fit
- An app built with AI tools that now has real users, payments or personal data.
- A launch, a raise or an enterprise deal in the next few months.
- A founder who wants the problems fixed, not just listed.
Not the right fit
- You only want the problems found and ranked. That's our code audit, from $5,000.
- You need a penetration test or a compliance audit. For SOC 2 or HIPAA readiness, see HIPAA and SOC 2 engineering.
- A prototype with no users yet. The free checklist is the right first step.
What you get
The audit, after week one
Every problem we find, ranked with evidence and the effort to fix it, and a fixed price for the fixes.
Fixes for the agreed problems
The high-severity problems we agreed on, fixed in the code and the database, with each change explained.
A test for each fix
So a later prompt or a new developer can't quietly undo it. Run them before each deploy.
A retest
Before handover, we re-run the audit's checks against the fixed app and tell you in writing which fixes hold.
A plan for the rest
Everything outside the three weeks, with the effort for each, in the order to do it.
A walkthrough call
A call with you and your developer to go through what changed and what's next.
What we've done for clients
Hexis
Rebuilding the platform behind elite sports nutrition
Sachin moved Hexis off hosted Supabase to its own Google Cloud setup, defined entirely in Pulumi, with PostgreSQL replicated across regions.
Read the Hexis case studyEmblem
AI due diligence that cites its sources
Sachin led Emblem's platform as CTO, including the Google Cloud infrastructure and the security work behind its SOC 2 program. Emblem has completed SOC 2 Type II.
Read the Emblem case studyHow a project starts
From a free call to the end of the second week.
A free 30-minute call
Tell us what the app does, what it was built with and what data it holds. We'll tell you whether a cleanup, an audit or the free checklist fits. If the app has paying users, funding or regulated data, send us its link when you book: we'll spend up to an hour on it before the call and send you three findings in writing afterwards.
A fixed price, or hourly
After the call we send a fixed-price quote for a clear scope, or agree on hourly work at $100 to $150 an hour. A cleanup is a fixed price from $8,000 for one app over three weeks. The first week's audit sets the final price, in writing, before any fixing starts. If you only want the problems found and ranked, the code audit is from $5,000 over two weeks.
The first two weeks
- A kickoff call, then read-only access to the code and the database settings.
- Week one: we trace sign-in, payments and customer data, rank every problem, and send you the list and the fixed price for the fixes.
- Week two: once you've agreed, fixing starts with the highest-risk problems, each with its own test.
Frequently asked questions
What is vibe coding cleanup?
Fixing an app that was built quickly with AI tools so it's safe to run with real users: closing data leaks, moving secret keys out of the browser, and adding the sign-in checks and tests the first version skipped. The app keeps its features.
How much does a vibe coding cleanup cost?
From $8,000 for one app over three weeks, at a fixed price. The first week is an audit, and it sets the final price, in writing, before we fix anything.
What if the audit finds more than three weeks of work?
Before fixing starts, we agree on which problems the three weeks cover, highest risk first. The rest goes into a plan with the effort for each, for your team, or for us at a separate quote.
Do you rewrite the app?
No. We fix what's there, so the features your users rely on keep working. If part of the app would cost more to fix than to rebuild, the audit says so, with the effort for each.
Can we keep building with AI tools afterwards?
Yes. Run the tests we add before each deploy: if a later change undoes a fix, a test fails.
Is this a penetration test?
No. We read the code and the project's settings and fix what we find. In a penetration test, security testers attack the running app to find a way in. If you need one, or a compliance audit, we'll say so on the first call.
Do you only work on Lovable apps?
No. Apps built with Bolt, Cursor, Claude Code or by hand get the same three weeks. If your app is on Lovable and you only want the problems found, see the Lovable security audit.