The crane
It worked in the demo.
You built it in Lovable, Bolt, Replit, Cursor, or v0, and it demoed well. Then real users showed up and it started doing things you did not ask for. This is normal. Those tools build for one user, no attackers, and no Monday morning.
We read the code, list what is wrong in order of how much it can hurt you, fix the list, and leave tests behind so it stays fixed.
Free. Paste a URL. No account. The list before you talk to us.
Read-only access is enough. You get a ranked list of what can hurt you, then a quote.
- access
- read-only is enough
- rule
- keep what works, rebuild only what does not
- stack
- stays, unless the code itself is the problem
- built in
- Lovable, Bolt, Replit, Cursor, or v0
The last stretch is not glamorous.
In our experience AI gets a first version roughly 70 percent of the way, a rule of thumb rather than a measurement. The remaining stretch is what breaks in production, and that is the part our senior engineers own.
The generators are good at the parts a single user sees. The parts that break are the parts a single user never sees: the policy on the table, the second run of the migration, the queue at nine on Monday.
On SusVibes, a CMU benchmark of 186 real feature requests published at ICML 2026, 57% of SWE-agent with Claude 4 Sonnet's solutions were functionally correct but only 11.8% were secure, and hinting at the vulnerability did not fix it.
Zhao, Wang, Zhang, Luo, Li and Li, Is Vibe Coding Safe? (CMU, ICML 2026).
Sign-in that works for you and also works for someone who is not you. Sessions, resets, and role checks that were never tested against an attacker.
Row-level security missing or disabled on the generated schema, so the public key reads and writes every table.
API keys shipped to the browser because the generator put them where the code needed them, not where they were safe.
A migration that runs once in the demo and twice in production, and takes the data with it the second time.
Background jobs that ran fine for one user and pile up when a hundred show up on the same Monday.
One database, one set of keys, one environment, so a test run is a production event.
Either none, or never restored, which is the same thing.
A usage bill nobody can explain, because nothing meters what the app spends.
Not every app has all eight. The scan tells you which ones yours has.
Most of these apps need a mechanic, not a new car.
We will tell you which one you have before you pay for either.
The rule: we keep what works and rebuild only what does not. A rebuild is the answer when the data model is wrong at the root, when the framework the generator picked cannot do what the product needs, or when fixing would cost more than starting over with the parts that are fine. Otherwise it is a mechanic's job, and we say so.
The estimate comes back as a ranked list: what can hurt you most, first. You can take the list to someone else. Some people do.
Mechanic
The product works and the plumbing does not. Auth, policies, secrets, migrations, backups, monitoring, and tests on the paths that matter. The stack stays.
Partial rebuild
One layer is wrong at the root, usually the data model or the job system, and everything above it is fine. We rebuild the layer and keep the rest.
New car
Fixing costs more than starting over. We say it plainly, keep what is salvageable, and quote it as a product build instead of a rescue.
Your AI-built app made boring: secure, tested, monitored, and ready for real users. We keep what works and rebuild only what does not.
Founders whose Lovable, Bolt, Replit, Cursor, or v0 app broke at first real users, and SMBs who bought an internal tool nobody can maintain.
- A ranked list of what is wrong, in order of how much it can hurt you, before you pay for anything.
- Auth and data-layer fixes, migrations that run twice without damage, backups that restore.
- Tests on the paths that matter, so it stays fixed.
- CI, observability, cost controls, and a handover document.
- The option to move to a retainer, stated plainly in the handover.
- evals
- A test or eval harness that defines done in a way a machine can check, kept in the repo.
- observability
- Logs, metrics, and an error monitor you can open without us.
- runbook
- A written runbook: how to deploy, how to roll back, what pages whom, what the bill is.
- 30-day fix warranty
- Anything we shipped that breaks within 30 days, we fix without a new quote.
The house standard is stated once, on the pricing page: evals, observability, a runbook, and a 30-day fix warranty.
Refusals, in writing.
A rescue shop that never turns down work is a shop that will migrate your stack because it prefers its own. These are the lines.
- No forced stack migrations. If it runs on Supabase and Next, it stays on Supabase and Next unless the code itself is the problem.
- No quote before we have read the code. Read-only access is enough.
- No rescue without a scan first.
- No guaranteed launch dates. We give a plan with dates and we tell you the day it slips.
Quoted after we read the code, never before.
The quote is fixed once we have read the repo, and it comes with the ranked list of what we found, so you can see what you are paying for and what you are choosing to leave.
If you continue to a retainer after the rescue, the retainer is $5k to $15k a month, and the handover document says so in plain words.
You run the scan, or we run it with you on a call.
You give us read-only access to the repo. We read it and send the ranked list with the quote.
The rescue, at the fixed price in the quote, with the house standard at handover.
This is a real sequence, which is why it is numbered.
The one rescue shop that publishes prices (Justin McKelvey, as of June 2026) lists light rescues from $15K, typical $25K to $50K over four to eight weeks, and complex SaaS at $60K to $100K. That is the published market, not our price. Justin McKelvey, Vibe Code Rescue.
This is not our opinion.
Every figure below is someone else's measurement, stated the way its source states it, with the vendor named where the source is a vendor and the dispute noted where there was one.
We do not have our own statistics yet. When the scanner has run enough times to say something honest, the number will appear on the scan page with a date and a method.
In May 2026 security vendor RedAccess reported about 380,000 publicly reachable apps and assets built with Lovable, Base44, Replit and Netlify; more than 5,000 had virtually no authentication and close to 2,000 appeared to expose private data. The platforms disputed how the findings were disclosed.
- source
- WIRED
- dated
- May 7, 2026
In Veracode's 2025 tests across more than 100 models, 45% of AI-generated code samples failed security checks and introduced OWASP Top 10 vulnerabilities, with security performance flat regardless of model size (vendor-reported, July 2025).
- dated
- July 2025
Veracode's March 2026 update, covering GPT-5.x, Gemini 3 and Claude 4.5 and 4.6, found the secure-code rate “essentially flat” at about 55% pass and 45% fail, “virtually identical to where they stood two years ago” (vendor-reported).
- dated
- March 2026
CVE-2025-48757 (published May 29, 2025) describes insufficient row-level security in Lovable-generated apps through April 15, 2025; the discloser's scan found 170 of 1,645 apps with databases readable and writable through the public anon key, and Lovable disputed the classification.
- dated
- May 2025
In July 2025 Replit's coding agent reportedly deleted a live production database during a declared code freeze, generated about 4,000 fabricated records, and told the user a rollback was impossible when it was not (AI Incident Database incident 1152; Replit's CEO apologized).
- also
- The Register
- dated
- July 2025
66% of developers say their biggest frustration with AI tools is solutions that are “almost right, but not quite” (Stack Overflow 2025 Developer Survey).
- dated
- July 2025
45% say debugging AI-generated code is more time-consuming (Stack Overflow 2025 Developer Survey).
- dated
- July 2025
Tell us what is broken.
Run the scanner first if you want the list before you talk to us. If you already know, send the repo. An engineer reads it, not a closer.
Free. Paste a URL. No account.
Read-only access is enough. A human engineer reads every message and replies within one business day, Pacific time.
No case studies yet under this name, and we will not invent one. What you can check: the scanner on your own app, and the log of what shipped on this site with dates on it. See the scanner and the log.