Lovable, Bolt, Replit, v0, and Cursor make it easy to ship something that looks finished. The gap is everything underneath: who can see whose data, what happens under load, and what breaks at the edges. We review that gap.
No dismissiveness about AI tools — we use them too. This is about what has to be true before real customers, staff, or money flow through it.
These are the things AI builders rarely get right on their own — and the ones that hurt once real people are using the thing.
Can one user see another's data? Are admin actions actually protected, or just hidden in the UI?
Where does customer/staff data live, who can read it, and is it exposed in API responses or logs? Real GDPR exposure starts here.
API keys and credentials hard-coded in the front end or committed to the repo are the most common AI-prototype leak.
What happens with bad input, concurrent users, or a third-party outage? Demos test the happy path only.
Is it hosted somewhere you control, can you deploy a fix, and is the data backed up — or is it one accidental delete from gone?
Can it be changed safely later, or is it a tangle only the original prompt understood? This decides harden-vs-rebuild.
The specific things that would bite you with real users, ranked by how badly.
Whether the prototype is a solid base worth hardening, or a great spec for a clean rebuild.
The minimum to make it safe to put in front of real users — not a gold-plated rewrite.
If your prototype is genuinely OK for its current use, we'll tell you that and save you the spend.
What did you build it with, what does it do, and who's going to use it? A link or a screen recording is ideal, but a description is plenty to start. We'll reply with the main risks and an honest recommendation.
Yes — the first look is free and no-obligation. Describe or link the app and we reply with the main risks and an honest recommendation.
No. If your prototype is genuinely fine for its current use, we will say so. We only recommend hardening or a rebuild where real users or real data are actually at risk.
Authentication and access control, data handling and exposure, secrets and API keys, reliability under load, deployment and backups, and whether the code can be maintained safely.
Anything AI-built or no-code — Lovable, Bolt, Replit, v0, Cursor and similar — plus n8n, Zapier and Make automations.
A link or a short screen recording, plus a sentence on who will use it. Please do not paste secrets or API keys.