For codebases built with Claude Code · Cursor · Lovable · Bolt · Windsurf
You built it with AI.
Now ship it with confidence.
A CTO with twelve years shipping real-money systems reads your repository end to end and hands back the findings ranked by what actually breaks first. Fixed fee, published on the pricing page, five to seven business days.
$1,500 fixed · 5–7 business days · reply in two business days
- 01 · AI-built MVP
- 02 · Production Audit
- 03 · Fix Sprint
- 04 · Fractional CTO
Route reads the users table. No session check. Public endpoint.
Illustrative — a composite of findings from real audits, not a live scan of any repository.
The gap
The bottleneck moved.
It did not disappear.
AI codegen is a real breakthrough. Founders who could never have shipped a product now ship one in a weekend. What used to be hard — getting something working — got genuinely easy.
Every AI-generated codebase I have read shares a shape. It is solid along the path the demo takes and soft everywhere that path skips. Auth that authenticates but never authorises. Keys committed in the first hour of a project and still live. Endpoints that will happily run a thousand times a second against a metered API.
These are the things a senior engineer is hired to notice. Reading for them is the whole job, and it takes about a week.
What the audit finds
The failure modes that repeat
Structural gaps that turn into an incident, a bill, or a data leak the first time real traffic arrives.
ordered by blast radius
- SECRETS_LEAKED
Secrets in the client bundle
A stripe key, an OpenAI key, or a database URL ends up prefixed NEXT_PUBLIC_ or committed in .env.local. Any visitor can read it.
audit → Full sweep of the client bundle + git history for anything key-shaped. - NO_AUTH_BOUNDARY
No auth boundary on API routes
The dashboard is behind a login screen. The API routes it calls are not. Anyone with the URL reads every user.
audit → Every route handler classified: public / user / admin. Gaps flagged. - NO_RATE_LIMIT
No rate limiting or abuse controls
One curl loop against an LLM endpoint drains your Stripe balance overnight. AI-written code almost never ships throttles.
audit → Per-route abuse model + a concrete throttle recommendation. - N_PLUS_1
N+1 queries at first real traffic
The list page runs one query for the list, N for each row. Fine at ten users, fatal at a thousand.
audit → Query trace on the top-5 hot pages. Slow paths named, not guessed. - NO_MIGRATIONS
Unversioned schema (no migrations)
The schema was edited in place with prisma db push. The next production deploy silently drops columns and their data.
audit → Migration state audited; safe-forward path written into the report. - UNBOUNDED_COST
Unbounded LLM cost per user
No token cap per request, no per-user quota, no cost model. The first viral thread on X is a billing incident.
audit → Cost model per user + a hard cap wired into the recommendation. - NO_OBSERVABILITY
No error tracking, no logs
Something is broken in production right now and you do not know. Nothing tells you which route, which user, which build.
audit → A minimal observability floor: what to instrument, where, this week. - NO_CI_NO_TESTS
No CI, no tests, direct-to-main
Every merge is a deploy, every deploy could break a paying user, and there is no safety net. AI writes code fast; regressions are just as fast.
audit → A pragmatic test + CI floor scoped to the load-bearing paths only.
What the audit hands you
5–7 business days · fixed fee- A1
Architecture map
Every route, every service, every trust boundary — on one page.
- A2
Load-bearing risk register
What breaks first, second, third. Ranked by likelihood × blast radius.
- A3
Threat model
Auth boundaries, secrets, PII surface, abuse vectors — named and rated.
- A4
Prioritised fix list
Ordered by risk, not by ease. Each item scoped to a day, a week, or a quarter.
- A5
Cost model
Per-user infra and LLM cost — and the caps to install before your first spike.
- A6
Live 60-minute walkthrough
A recorded call. Findings, tradeoffs, questions. Not a PDF thrown over a wall.
Scope, stated plainly
An audit is a point-in-time expert review. It is a written assessment by a senior engineer, and it is worth something in a diligence conversation.
It is not a certification, not a penetration test, and it cannot prove your code is free of defects — no review of any depth can. That limit is written into the terms rather than buried.
A human reads the code. Tools help with the search. Deciding what matters at your stage is the part that is not automated.
Read a complete published audit — eleven findings on an AI-generated codebase, ranked, with what each would have cost.
Book
Pick a time and we will talk
Thirty minutes, no obligation. If an audit is the wrong purchase for what you have built, you hear that on the call rather than after an invoice.
Book a fit check
Thirty minutes, no obligation either way. If an audit is the wrong purchase for what you have built, you will hear that on the call.
- 30 minutes
- Video call
- Reply in 2 business days
Availability
Real users are coming. Find out what happens when they arrive.
$1,500, fixed. You leave with an architecture map, a threat model, a ranked fix list, a cost model, and a recorded hour with the person who wrote them.