What exactly do I get at the end of the audit?

One document, delivered as a PDF and as Markdown you can commit with the code. Every finding is tied to a file or configuration, with its severity, what fails in production, and how we confirmed it. It also includes a single priority list, estimates in hours at our flat rate, and a roadmap for the next one to three months.

How long does an audit take?

A small micro-SaaS usually takes about a week from the moment we have repository and account access. A larger product with several services and integrations takes around two weeks. We confirm the delivery date before starting, and we keep the read-only access as narrow as the work allows.

Do I have to give you production access?

No. Read-only access to the repository, the database structure, and the deployment configuration covers most of the work. Where a problem only appears in production, we agree on the smallest access that settles it, or we give you a command to run and work from the output.

What happens if the audit finds something serious?

It goes to the top of the priority list with the reasoning and the fix pattern attached. If it concerns a live secret or an open admin route, you hear from us the same day instead of waiting for the document. Fixing it stays your decision, and we quote a rescue sprint if you want us to handle it.

Will you sign an NDA, and what if the code is better than I fear?

We sign an NDA before anything is shared, and the repository stays in your accounts throughout. If the codebase is in better shape than expected, the document says so plainly and the remaining budget stays yours to spend on features.

Vibe-Coded Product Audit & Fix Plan

Fixed-price audit of an AI-built micro-SaaS: severity-ranked findings, a prioritised fix list with effort estimates, and a realistic production roadmap.

See our work:

Big Mail Project→SmartAIChats→Vasilkoff.info - AI Project Estimator & Chat Support Web App→

Your product works. People signed up, some of them pay, and the feature requests in your inbox come from customers who intend to stay. The questions that follow are the ones a prototype never had to answer. Can a second developer add a feature without breaking checkout? Are the AI keys sitting in the browser where any visitor can copy them? Does the database hold up when usage triples? Who actually owns the domain, the hosting account, and the payment provider?

An audit answers those questions in one pass, then puts a price and an order on the work that follows. Founders use it before committing a build budget, before hiring, and before handing the product to a new developer. Vibe-coded app rescue is the wider service that includes the repair work. This page covers the audit alone, and the shape of it is a micro-SaaS technical audit: architecture, security, dependencies, and ownership in one pass, ranked by what threatens revenue and user data first.

What the audit is for

An AI coding tool got you to a working product cheaply, which was the right trade while the only open question was whether anyone wanted it. The cost of the shortcuts arrives later, once money, identity, and stored data depend on code nobody has fully read. An audit makes that debt visible: what is broken, what is fragile, what is fine, and what each fix is worth.

The output is a decision document. It tells you whether the product needs a rescue, a rebuild of one component, or nothing urgent at all. That answer is useful even when the news is good, because you can then spend on features knowing the risk underneath.

Who it is for

A solo founder with paying customers on a prototype built in Lovable, Cursor, or Claude Code, unsure how much of it can be trusted.
A non-technical owner whose developer moved on and left a repository the next person must reverse engineer.
A team facing a security questionnaire or due diligence and needing an independent read on the codebase.
An agency or fractional CTO that inherited a build and wants a second opinion before promising dates.

If the product is an iOS or Android app, the same audit runs through vibe-coded mobile app rescue, with native permissions, signing, crash reporting, and store review added to the checklist.

What you receive

The findings document

One document, delivered as a PDF and as Markdown you can commit with the code. Every finding names the file or configuration it touches, what fails in production, how we confirmed it, and a severity. Findings are grouped by area: deployment, data integrity, authentication and authorisation, billing and money paths, integrations and secrets, performance and running costs, tests and error tracking, and ownership of accounts.

Problems we cannot point to in the code go into a separate list of unverified risks, each with a note on what would settle it.

The priority order

A single ordered list, sorted by what breaks first and what costs most when it does. The top is the work that should happen before the next release. Each entry says whether it is a fix, a rebuild of one component, a configuration change, or a decision only you can make. The list is split into what blocks production, what should happen this quarter, and what should be deleted instead of maintained.

Effort and cost estimates

Every item carries an estimate in hours at our flat rate of $39, written as a range so a partial fix can be compared with the full one. Estimates name their assumptions, such as whether a payment flow can be repaired in place or has to be rebuilt around an idempotent write.

The production roadmap

A realistic sequence for the next one to three months: what stabilises the product first, what hardens it for a growing user base, and what the codebase can support afterwards. Dependencies are named, since a billing fix usually waits on the data model being settled.

A fixed-scope rescue sprint, if you want one

If you want the top of the priority list handled, we quote a fixed scope of work after the audit. The sprint covers what blocks production, at the same flat hourly rate. Scope is only fixed once the findings exist, because a price agreed before the code is read would be a guess. The wider programme, including architecture stabilisation, sits under vibe-coded app rescue.

What the audit does not include

It reviews code, configuration, and access paths. It is not a penetration test and does not run exploit tooling against live systems. Where that depth is needed, we say so and scope it under website security audit and malware removal.
It produces findings, not fixes, unless you order the sprint.
It does not cover design, conversion, search visibility, or app store listings.
It does not give legal advice on GDPR, PCI, or sector rules. We report where data handling looks risky and which obligation needs a lawyer's answer.
It audits your code and configuration, not the internals of the third-party services you call. We report what they expose and how your product handles the failure.
Exposed keys and browser-side AI calls are reported with the fix pattern, and the implementation runs through secure AI backend and API key protection when you want it built.

How the engagement runs

We start with read-only access: the repository, the database structure, hosting and deployment settings, environment variables, and provider accounts. A short call covers what breaks in production, what customers ask for, and what worries you about the code.

Reading takes most of the time. We trace the money and identity paths first, then the data model, then everything else. Questions come to you in a batch. A small micro-SaaS usually goes from access to finished document in about a week, and a larger application with several services takes two weeks.

The document arrives with a walkthrough call, so the priorities are clear even if you never touch code.

What it costs

An audit is quoted as a fixed price once we have seen the repository, because the size of the codebase and the number of services decide the work. Small products land in the low thousands of dollars, and a multi-service application costs more.

When the audit turns into a rescue sprint, the shape is comparable to the published AI assistant and workflow automation order on our pricing page, which runs $1,800 to $3,900 across one to three weeks. Any work outside a fixed scope runs at the flat rate of $39 per hour. Teams that need steady delivery after the audit use the monthly capacity plans from $2,699.

Proof

Vasilkoff.info is our own AI estimator and support application, built on Next.js with a separate backend service and embeddable chat widgets. It shows the separation we want whenever a product calls an AI model: the key stays on the server, and a failed model call cannot take down surrounding pages.

SmartAIChats is a conversational SaaS product with React, Next.js, Node, Express, MongoDB, and OpenAI in the stack. It shows what a chat prototype grows into once businesses depend on it, including a data model that survives real usage and setup that non-technical teams can finish.

The Big Mail Project is a full-stack platform for sending postcards online, built across Laravel, Node, React, and Next.js. It shows our habit of taking responsibility for the whole path, from the interface down to the database and the deployment.

Related services

Vibe-coded app rescue for the repair work that follows the findings, including architecture stabilisation and ongoing technical ownership
Vibe-coded mobile app rescue when an iOS or Android build needs the same treatment with store requirements included
Custom web application development when the audit shows the data model or the core architecture cannot carry the product
Website security audit and malware removal for access control, exposed secrets, and injected code that need a dedicated engagement
API development and integration for the third-party connections the product depends on

Next step

Send the repository link, a one-paragraph description of the product, and the failures you have seen, if any. We will reply with a fixed price for the audit and a date for the document.