You built it with Lovable, Bolt, Cursor, Replit, v0, Claude Code or ChatGPT. The demo works. Before real users, or real cards, go through it, run these eight checks. You do not need to be an engineer for any of them. Most take a few minutes.
AI builders get you most of an app quickly. The part they skip is the part real users find: the second login, the refund, the empty screen, the record that belongs to someone else. None of that shows up in a demo.
Go through the checks in order. Write down every one that fails. A short list is normal, and often something you can fix with a few careful prompts. A long list is useful too. It tells you what you are actually launching.
You ask for one change, it rewrites four files, and now two other things are broken. Every fix costs more than the last. That loop is the first sign the app has outgrown the prompt.
Run it yourself:
It fails if small changes keep breaking unrelated things, or you have stopped asking for changes because of it.
Auth is where generated code fails first. Sessions that drop. OAuth that is half configured. A password reset that quietly goes nowhere. You signed up once while building, so you have probably never seen these.
Run it yourself:
It fails if any of these surprise you. Each one is a support email waiting to happen.
The common state: Stripe is connected in test mode, webhooks were never handled, and nobody is certain what happens when a real card is charged. Test mode looks exactly like it works, because nothing real is moving.
Run it yourself:
pk_live_ and sk_live_. Test keys start with pk_test_ and sk_test_.It fails if the app only knows about a payment because the browser came back to a success page. That is the job webhooks do.
It runs in the builder and nowhere else. Environment variables, build steps, and domains turn into a wall you cannot get past. Or it is deployed, but only the builder knows how.
Run it yourself:
It fails if the only way to ship a change is the builder's publish button, and nobody knows what it does.
Keys in the frontend, a database anyone can read, no rate limiting. Usually nothing has gone wrong yet. That is not the same as safe. The day it has real users, it also has real data to lose.
Run it yourself:
secret, sk_ and key. A publishable key is meant to be public. A secret key in the browser is not.It fails if any one of these works the way an attacker would like. This is the check worth paying for help on, even if everything else passes.
The happy path demos beautifully. Everything either side of it, errors, empty states, edge cases, was never built. Real users find all three in the first week.
Run it yourself, on each main flow:
It fails if the user is left on a blank screen, a raw error, or a duplicate order.
With no tests, nothing tells you when something breaks except a user. Every release is a guess, so releases stop happening.
Run it yourself:
It fails if the answer to "how would you know" is "a customer would tell us".
The structure only made sense to the model that wrote it. A developer opening it now quotes you a rewrite. That is fine for a demo. It is a problem the day you need the second version.
Run it yourself:
It fails if nobody, human or model, can add to it without breaking what is there.
A short list you can often work through yourself. When most of the eight fail, the question changes from "what do I fix" to "what does fixing it take". Two of our case studies started there.
If the list came back long, the instant estimate tells you what fixing it costs. Seven questions, about two minutes, no email. It gives you one of these bands and a timeline. It is calculated from your answers with a fixed set of rules, not AI guessing, and it is a band, not a quote.
50% up front, 50% on delivery. The band is agreed in writing before work starts, so the number does not move while we work.
After the estimate, you can book a free 15-minute audit with an engineer who reads the actual code. You leave with a real number. If the app is beyond saving, we tell you then, before you have paid us anything. Sometimes the honest answer is that rebuilding the core is cheaper than untangling it. Sometimes it is that you do not need us at all.
Want to skip the estimate? Book a call directly.
Seven questions, about two minutes, no email. You see the price band at the end whether or not you talk to us.