You vibe coded it. Now find out if it’s safe to launch.
A Tech Alchemy senior engineer reads your code and checks security, data, scale and running costs. In 5 working days you get a ranked fix list, a straight verdict and a fixed-price quote to go live.
Nothing to pay today · See sample findings · Rather talk? 15-minute fit call
Sample · 6 of 8 areas
Launch readiness
React (Vite) + Supabase · built in Lovable
- Security & secretsBlocker
- Auth & data accessBlocker
- Data & backupsSome risk
- Payments & integrationsSome risk
- Performance & scaleReady
- Reliability & monitoringMissing
Verdict
Fix first. No rebuild needed.
Go-live quote
Fixed · 3 weeks
Reviewed on
Clutch · 20 reviewsGoodFirms · 18 reviews9 years · 120+ products shipped · 300+ engineers · London- 5 working daysor the review is free
- £1,950 fixedno hourly billing
- Hardening firstrebuild only if the evidence says so
- Read-onlywe never push to your code
Built with
LovableBoltReplitCursorv0Base44Claude CodeIt works on your laptop. That isn’t the same as ready for real users.
Lovable, Bolt and Replit get you to a working product fast. They skip the security and production checks that keep it standing once real users arrive.
Keys in the browser
API keys and service tokens shipped to the front end, where anyone can copy them and run up your bill.
Open database
Row-level security off or half set up, so one user can read or change another user’s data.
No way back
No staging, no tested backups. One bad prompt or migration and there is nothing to roll back to.
The bill nobody modelled
Hosting, database and AI costs that are fine at 50 users and painful at 5,000.
Usually the answer is to harden what you have. You need someone who has shipped production software to tell you what to fix and what to leave alone.
A verdict, a ranked fix list and a fixed price.
- 01Readiness score
Out of 100, weighted by severity, with a status for each of the eight areas. Any Critical finding makes an area a Blocker; High or Medium makes it Some risk.
- 02Launch blockers, ranked
Every finding rated Critical to Low, with the evidence and the fix.
- 03A straight verdict
Ship it, fix first, or rebuild the risky parts, with the reasons.
- 04Fixed-price go-live quote
Scope, timeline and price in writing, for us or any other developer.
- 0545-minute walkthrough
With the engineer who reviewed your code.
Sample findings · illustrative
- Service-role key in client bundleMaster database key visible to anyone in the browserCritical
- RLS policies allow all rows on 3 of 9 tablesAny logged-in user can read other users’ dataCritical
- Stripe webhook signature not verifiedSomeone could fake a “payment succeeded” messageHigh
- No restore process for backupsNobody has checked the backups would actually workHigh
- No tests on sign-up or checkoutNothing catches it when a prompt breaks loginMedium
- No error tracking in productionYou won’t know when things breakMedium
How one finding reads in the report
src/integrations/supabase/client.ts reads the service-role key from a VITE_ variable, so it ships to every visitor. Fix: move the call into a server-side function (a Supabase edge function), rotate the key and check the logs for use of the old one. About an hour.
Verdict
Fix first. No rebuild needed.
What we need from you
Read-only access to the repo (GitHub, GitLab, or an export from your AI tool), read-only access to your Supabase or Firebase project and hosting dashboard, a staging or live URL, and a 20-minute kick-off call. We look at schema, policies and settings, never your users’ data.
Built in Lovable? Turn on GitHub sync in Lovable’s settings, then add us as a read-only collaborator. We send you the steps.
Read by a senior engineer, from a studio with 120+ products in production.
Tech Alchemy is a London product engineering studio. We use AI heavily in our own work, so we know where it cuts corners.
Tech lead
Sachin Omprakash
Leads technical delivery on Tech Alchemy client builds
CTO
Jitender Bhutani
Leads engineering across the studio
One of these two leads your review and runs your walkthrough call.
- 0
Years shipping software
- 0+
Products taken to production
- 0
Client reviews on Clutch and GoodFirms
- W3 Sports
- EthoVentures
- DaraBase
- Kounotori
- Mercore
- Ocean Bottle
- Perro
Answer eight questions and see where you stand in about two minutes.
Answer from what you know today, in plain English. “Not sure” counts as half, because it usually hides a gap.
Your score shows instantly. Email is optional.
Security & secrets
Are your secret keys (Stripe secret key, Supabase service key, OpenAI key) kept off the website itself, so visitors can’t see them?
Eight areas where AI-built apps break.
A senior engineer reads your code and your setup, backed by automated scans. Each area gets a status and the evidence behind it. You don’t need to know what every item means. That’s our job.
Security & secrets
- Exposed keys and tokens
- Rate limits on sign-up, email and AI endpoints
- API routes and server actions that skip auth
- Dependency vulnerabilities and injection risks
Auth & data access
- Row-level security or Firebase rules, storage buckets
- Permission checks on the server, not just in the UI
- Session and password handling
Data & backups
- Schema and migrations
- Backup setup and restore process
- Staging vs production
Payments & integrations
- Stripe and webhook handling
- Third-party failure modes
- Retries and idempotency
Performance & scale
- Slow queries and N+1 calls
- Behaviour at 10× users, estimated from code and query plans
Reliability & monitoring
- Error tracking and logs
- Uptime alerts
- What happens when it breaks
Code health
- Structure a developer can take over, without dead or duplicated code
- Tests on critical flows
Hosting, cost & compliance
- Running cost at scale, including AI spend caps
- CI/CD and deploys
- GDPR and cookie basics
Not a penetration test or a compliance certification. If you need one, we’ll tell you.
Know where you stand in 5 working days.
- 01
Day 0
Request, confirm, pay
Send the form. Within one working day we confirm scope and send a payment link. Then you share read-only access to the repo and your Supabase or Firebase project, and we hold a 20-minute kick-off.
- 02
Days 1–4
We review
A senior engineer works through all eight areas. Anything critical, we flag the same day.
- 03
Day 5
Report & walkthrough
Your score, ranked findings, verdict and fixed quote, talked through on a call.
- 04
Your call
Go live
We do the fixes on a fixed price, or your own team works from the plan.
Start free. Know the price before each step.
Every step tells you the price of the next one before you commit, and nothing is billed by the hour.
Vibe Score
Free
2 minutes · self-serve
- 8-question self-check
- Instant score and first gaps
- Email optional, no call
Vibe Check
£1,950+ VAT, fixed
(£1,950 inc. VAT) · 5 working days · one product
- Senior engineer review across 8 areas
- Ranked findings and verdict
- Fixed-price go-live quote
- 45-minute walkthrough call
- Fee credited against go-live work within 30 days
- Free if the report is late (the clock starts once access is in place)
Go-Live Sprint
£5k–£15ktypical, fixed per quote
Fixed quote from your report · typically 2–6 weeks
- Small fixes you can do yourself? The report says so
- We fix the blockers and high risks
- Staging, backups, monitoring set up
- Most fixes stay in your current stack
- Launch support on the day
Build & Scale
Per teampriced monthly
Ongoing product team · only if you want it later
- New features, built to production standard
- Maintenance, fixes and upgrades
- Design, product and engineering
— The report is yours to take to any developer
— Prices exclude VAT
There are cheaper ways to find out. They cost more later.
| Option | Cost & time | What you actually get |
|---|---|---|
| Launch and hope | Nothing up front | You find the problems when your users do, or when someone finds your keys. |
| Free automated scan | Free, minutes | Checks your live URL from the outside. Nobody reads your code, and there’s no fix plan or price. |
| A freelancer “has a look” | Hourly, open-ended | Depends on who you get. No fixed scope, no written quote to compare. |
| Rebuild from scratch | Months, full build cost | Throws away what already works, which is often the part your users like. |
| Vibe Check | £1,950 fixed, 5 working days | A senior engineer reads your code. You get ranked fixes, a verdict and a fixed-price quote, and the fee comes off go-live work. |
Built for people with a working product and a launch date.
A good fit
- ✓Founders who built with Lovable, Bolt, Replit, Cursor or similar and are about to take payments or real user data
- ✓Teams inside a business who built an internal tool that’s now business-critical
- ✓Founders heading into a raise who want a clear view of their tech before investor due diligence
- ✓Anyone who inherited an AI-built codebase and needs to know what’s in it
Not the right fit
- ✕You don’t have a working app yet. Talk to us about Product Discovery instead.
- ✕You want a code audit for a large, multi-team platform. We’ll scope that separately.
- ✕You want a report to file, not a plan to act on.
Yes, read-only. We review the code itself, not just the live site, plus read-only access to your Supabase or Firebase project and hosting dashboard, because that is where security rules and backups live. GitHub or GitLab access is easiest, and Lovable, Bolt and Replit can all sync to GitHub. We look at schema, policies and settings, never your users’ data. We never push changes, and we remove our access at hand-over. You can revoke it at any time. NDA on request.
Know if it’s ready before your users find out.
£1,950 + VAT, fixed. Report in 5 working days from access, or the review is free. The fee comes off your go-live work if you start within 30 days.
- Reply within one working day
- Read-only access, NDA on request
- If it’s too big for a fixed review, we tell you before you pay
Rather talk first?