Your AI built it.
Now it has to survive real users.

You built something real with Claude, ChatGPT, Gemini, Cursor, Lovable or Replit. It works. Getting it safely in front of strangers is a different job — hosting, security, backups, payments, the law — and it is the one nobody handed you. That job is what I do.

How this usually goes

I look first. I go through your app and send you a written report in plain language, ranked by what will actually hurt you. Not a scanner dump.
Then I fix what needs fixing. Deployment, domain, certificates, secrets, database, backups, rate limits, monitoring.
Then I stay reachable. For when it is live and something goes wrong at an inconvenient hour.
Or I teach you instead. Some founders would rather learn this than outsource it. I will sit down with you, in person if you are nearby.

Work starts with a paid review. If you are not ready for that yet, the list below is yours to work through for free.

Where AI-built apps usually break

A login that only checks who you are in the browser.
API keys shipped to the browser, where anyone can read them.
A database with no backup, on a free tier that quietly expires.
No rate limit, so one script can drain your model credit overnight.
Prices sent up from the customer’s browser.
Personal data collected with no idea what Canadian or European law asks of you.
Secrets committed to the repository, still sitting in the history after you delete them.
No logs at all, so you cannot tell whether something has already happened.

That is the short version. The full list is twelve things, and you can score yourself against it — free, and nothing you tick leaves your browser.

Three of those, in the code

Skip this if it is not your language. It changes nothing about what I would do — email me either way.

const openai = new OpenAI({
  apiKey: "sk-proj-4f8Kx7Qm...",
  dangerouslyAllowBrowser: true
})

The library is telling you, in the name. Anyone who opens your site can read that key and spend your money.

app = Flask(__name__)

app.run(
    host="0.0.0.0",
    debug=True,
)

That switches on Werkzeug’s interactive debugger. Bound to 0.0.0.0 it is reachable from the internet, and any unhandled error hands a stranger your source, your file paths and your environment — with a Python console behind it.

fetch("/api/checkout", {
  method: "POST",
  body: JSON.stringify({
    priceCents: 499
  })
})

That number came from the page, and the page belongs to whoever is looking at it. Sending 1 instead is the same amount of work.

Get in touch

I read and answer it myself.

Already broken, or already breached? Put that in the subject line.

Please don’t email me your API keys. If you were about to, that is exactly why you should get in touch.

On bigger jobs I bring in people I have worked with, and the work is still mine to answer for. LinkedIn.