Why a fixed scope instead of fixing whatever we find?

Because the list of things one could fix in a generated codebase is endless, and a sprint that keeps growing never ends. The audit on days one and two sets the list; the remaining eight days work through it in risk order. Anything left over goes on the roadmap with an estimate, not into an invoice.

Will the app go down during the sprint?

No. Every change ships behind the running product, on a staging environment first. Moving to your own hosting, if that is part of the sprint, is a DNS change at the end, made when you say so.

What if the audit shows the app needs a rebuild, not a sprint?

We say so on day two, hand you the findings, and you decide. If you stop there, you pay for the audit only. If you continue into a migration, the sprint price counts towards it.

Which platforms do you work with?

Applications built with Lovable, Bolt, v0, Cursor, Replit and similar tools, typically on Supabase or Firebase with a React front end. We moved our own site off Lovable and Supabase in September 2026, so the traps are familiar.

Do we have to keep working with you afterwards?

No. Everything is in your accounts and your repositories, and the runbook is written for whoever comes next. Many clients do stay — for the roadmap items or as their engineering team — but nothing in the sprint depends on it.

Run the free audit on this site, then book a call. We confirm the fit, the price and the start date on that call. We run one sprint at a time, so the start date is the first thing we check.

Fixed offer

The MVP Hardening Sprint

Two weeks, one senior team, fixed scope. Your AI-built app keeps running while we take the risk out of it: secrets, access control, hosting you own, backups, tests, monitoring and a handover your next engineer can read. No rebuild, no feature work — just the things that stand between a working prototype and a product someone can rely on.

Run the free audit first Book the sprint

The audit is free and takes a minute. The sprint starts from what it finds.

Duration: 10 working days
Team: Two senior engineers, one of them the lead you talk to
Price: Fixed price, confirmed on the call

Who it is for

Built with Lovable, Bolt, v0, Cursor or Replit — and now it matters

The sprint fits when

Real users or paying customers are on the app today
A customer, investor or partner has sent a security questionnaire or a due-diligence list
You do not know for certain who can read which data, or where the keys live
The app runs only on the platform that generated it, on a domain or hosting you do not control
You want to keep shipping, not stop for a rewrite

It does not fit when

There are no users yet — keep iterating, and run the free audit when you launch
The product needs a new data model or a different architecture — that is a migration, not a sprint
You want new features or a redesign — we do that, but not inside this offer

The ten days

What happens, in order

The order is the risk order. Whatever would hurt you most if it went wrong tomorrow is handled first, and each block ends with something you can verify yourself.

Days 1–2
Audit
We read the code, map the data model and the access rules, find every secret and every third-party dependency, and cost the hosting. You get a written list of findings ranked by risk, and we agree what the remaining eight days fix.
Days 3–6
Security and ownership
Secrets out of the front-end bundle. Access rules fixed and covered by tests. Security headers. The app on a domain and hosting you own, or a clean move to them. Backups that have been restored once, so we know they work.
Days 7–9
Data, cost and visibility
The obvious schema traps closed and indexed. Rate limits and cost caps on AI calls. Error tracking, uptime monitoring and a staging environment. A CI pipeline that runs the tests on every change.
Day 10
Handover
An architecture note, a runbook, and a roadmap that says what should be rebuilt later and what can stay as it is. One walkthrough session with whoever will maintain the app next — you, your hire, or us.

What you have at the end

Nine things you can point to

Audit report
Findings ranked by risk, with what was fixed and what was deliberately left.
Secrets where they belong
Nothing sensitive in the bundle, in the repository or in a prompt.
Tested access control
Who can read and change what, written down and covered by tests that fail if it changes.
Your own domain and hosting
Accounts in your name, and a deploy you can run without us.
Backups you have seen restored
Scheduled, off the production machine, and tested once during the sprint.
Staging and CI
A place to try changes before customers see them, and a pipeline that runs the tests.
Monitoring
Errors, uptime and AI spend visible on one screen, with alerts that reach a human.
Runbook and architecture note
How to deploy, roll back, rotate a key and restore a backup. Two pages, not forty.
Roadmap
What to rebuild later, what to leave alone, and an honest estimate for each.

How the two weeks run

You see everything, as it happens

The sprint runs inside Golux Club, the client portal every engagement gets: each finding is a ticket with an owner and a due date, every decision that needs you is an approval you click, and every file lands in one place. No status meetings; the record is the status.

See Golux Club

Questions before booking