Built it with Lovable, Bolt or Cursor? A senior engineer to finish, secure and host it

You did the hard part: you turned an idea into something people can click. What is left is the part AI tools skip. Who can see whose data, where the keys live, what happens when a payment fails, and who gets the call when it goes down. That is engineering, and it is what we have done since 2003.

We take apps built with Lovable, Bolt.new, Replit, Cursor, v0, Base44 and Claude Code, find the security holes, fix what is broken, and run them on proper hosting in New Zealand. We work AI-first ourselves, so we will not make you throw your prototype away.

The demo works. Here is what usually breaks next

• Each new prompt fixes one thing and breaks another, and the credits keep burning.
• The app is stuck at 80%: logins, payments or emails never quite work.
• It runs on the builder's own hosting and you cannot move it.
• There is no staging site, no backup and no way to roll back a bad change.
• Nobody has checked who can read the database.

The security holes we find most often

• Supabase Row Level Security off or too broad. The anon key ships in every front end by design, so a table without the right policies can be read, and often changed, by anyone.
• Secret keys in the browser or the git history. OpenAI, Stripe and Supabase service keys visible to anyone who opens the developer tools.
• Access checks only in the interface. The admin button is hidden, but the API answers anyone, and changing an ID in the address shows another customer's record.
• No rate limits on paid features. A script can run up your AI, SMS or email bill overnight, or try passwords until one works.
• Payments that trust the browser. Stripe webhooks without signature checks, and retries that create duplicate orders.
• Open storage buckets holding uploads, ID photos or invoices.

Real incidents, and what they teach

• In May 2025 a researcher scanned 1,645 apps from Lovable's showcase and found 170 exposing user data through missing database policies (CVE-2025-48757). Lovable's position was that each customer is responsible for their own app's data.
• In October 2025 Escape.tech scanned 5,600 public vibe-coded apps and found more than 400 exposed secrets and 175 cases of exposed personal data, including medical records and bank numbers.
• In July 2025 Wiz found that Base44 apps could be joined with nothing but a public app ID, bypassing single sign-on. It was fixed within a day.
• Also in July 2025, Replit's agent deleted a live production database during a code freeze.

The pattern is the same each time: the tool built what was asked for, and nobody asked the security questions.

Why trust us with it

Taking over code someone else wrote is most of what we do. This year alone we inherited a Shopify app estate and found 16 of 17 old cloud functions still running and a free-shipping promotion that had never worked; we removed 30 scripts anyone could run from a browser on a health provider's WordPress site; and we added automated tests to five live systems that had none, which found real faults on the first run. We build with AI agents every day, so we know exactly where they cut corners.

Your obligations under the Privacy Act

If your app holds customer information, you are responsible for it, not the tool that built it. Under the Privacy Act 2020 a business must notify the Privacy Commissioner and the people affected about a privacy breach that is likely to cause serious harm. An audit before launch is far cheaper than that conversation.

A written audit, then a fixed-price fix

You see the audit findings before you commit to anything else, and the fix is a fixed price. No hourly meter.

Keep, harden or rebuild: how we decide

Most AI-built apps are worth keeping. If the structure is sound we harden what is there. If one part is beyond saving, usually the data layer, we replace that part and keep the rest. A full rebuild is the last option, and if we recommend it you get the reasons in writing. Our own web app builds start from $4,990 if it comes to that.

A real database, auth, payments and deploys

• Move off the builder's hosting to your own accounts: Supabase, Postgres, Vercel or our servers
• Migrate from Lovable Cloud to your own Supabase project
• Proper sign-in, password resets and roles
• Stripe set up properly, with webhooks you can trust
• Email that lands in the inbox, and SMS through a New Zealand number
• A staging site, automated tests and one-click rollback

Keep building with your AI tool afterwards

You can keep using Lovable, Cursor or Claude Code for the parts you enjoy, such as screens and copy. We look after the parts that need an engineer: the database, security, payments and deploys. We also show you how to prompt so the next change does not undo the last fix.