The prototype already did its job
An MVP generated with Claude, Cursor, Lovable, v0 or Codex answers one question: does anyone want this? If you got this far, you have that answer, and it is worth more than any specification document. The code that produced it was written to demonstrate something fast. Lasting was a different goal, and nobody asked for it.
- Validating fast is the right way to start
- A prototype aims at an answer; production asks for something else
- What is missing can be listed and estimated before you begin
What is almost always missing
After opening a fair number of codebases built this way, the gaps repeat. You ask a generator for a feature. Nobody asks for a database access policy, and the tool does not add one on its own.
- Authentication present but authorisation absent: anyone with an account sees everyone's data
- Keys and secrets in client code, visible from view-source
- No server-side validation: the check exists only in the form
- Errors reaching the screen with a stack trace instead of being handled
- Queries with no indexes, fine at 50 rows and stalling at 50,000
- No backups, no monitoring, no way to notice something broke
The audit: what we look at, in what order
Before proposing any work we read the code and use the application. The output is a document listing what we found, ordered by actual risk. It usually takes 2–5 working days.
| Area | What we check | Why it matters |
|---|
| Security | Authentication, per-role permissions, database policies, exposed secrets, input validation | The only category where a mistake stays invisible until it is too late |
|---|
| Data | Table structure, relations, indexes, migrations, backups | Changing the data model after launch costs ten times as much |
|---|
| Reliability | Error handling, loading states, edge cases, what happens when a call fails | Decides whether the user sees a clear message or a blank page |
|---|
| Performance | Slow queries, bundle size, images, Core Web Vitals | Drives both infrastructure cost and ranking |
|---|
| Maintainability | Duplication, types, folder structure, abandoned dependencies | Sets the price of every future change |
|---|
| Going live | Environments, variables, domain, monitoring, logs | So you notice problems before a customer does |
|---|
What we leave alone
An honest audit also says what to keep. Rewriting to personal taste burns budget and leaves the product where it was.
- If a library works and has no known holes, it stays, even where we would have picked another
- If the design holds up, we do not redo it just to sign it
- If a piece of code is ugly but isolated and stable, it is low priority: we flag it and move on
- If the MVP is already solid, we say so and you pay for the audit only
Indicative bands (2026)
Price depends almost entirely on one variable: how tidy the existing work is. A careful MVP is cheap to secure; a codebase grown in layers takes more. The audit exists partly to tell you which of the two you have, before committing a budget.
| Engagement | Indicative band | What it covers |
|---|
| Audit only | €800 – €1,500 | Full review and a document with priorities, risks and effort estimates. Deducted from the quote if you go ahead |
|---|
| To production, contained scope | €3,500 – €6,500 | Security and permissions fixed, error handling, correct deployment, basic monitoring |
|---|
| To production, broad scope | €6,500 – €12,000 | Wider refactoring, revised data model, performance, minimal documentation |
|---|
| Ongoing technical ownership | from €9,000 | We become the product's technical lead: evolution, maintenance and new features |
|---|
How it runs
No stage starts before you have seen and approved the previous one. The audit is also the point where you can stop: the document is yours and you can hand it to anyone.
- Read-only access to the repository and the live application, if there is one
- Audit in 2–5 working days, with a document and a walkthrough call
- Fixed quote on the work you choose, with dates
- Delivery in blocks, with the application working between each one
- Handover with access, essential documentation and a walkthrough
Frequently asked questions
Is AI-generated code throwaway?
Almost never. In most cases the structure holds and specific things are missing: permissions, server-side validation, error handling, database indexes. Those are contained gaps. The opposite happens too, with codebases too tangled to fix at sensible cost, and when it does we say so immediately, with only the audit to pay for.
Why an audit before a quote?
Because without opening the code any number would be invented. Two MVPs that look like they do the same thing can need very different work. The audit is cheap so you can find out which of the two you have before committing a large budget.
Which tools have you worked with?
Mostly projects started with Claude Code, Cursor, Lovable, v0, Bolt and Replit, on Next.js, React and Supabase or Firebase. If yours sits on something else, ask: if it is outside what we know, we will say so rather than improvise.
Do you use AI to write code yourselves?
Yes, every day, and that is part of why we spot fast what a generated project is missing. What counts is knowing what to ask it for, what to verify by hand and what to keep out of the delegation: permissions, data model, security.
Do I keep the audit document?
Yes. It is yours and you can use it however you like, including to get competing quotes. If you go ahead with us, the audit cost is deducted from the quote for the work.
How long until it is live?
After the audit, a contained scope usually takes 2–4 weeks and a broad one 4–8. The main variable is how many product decisions are still open: the technical part is usually the most predictable.