Your app worked in the demo. It is falling over with real users.
Tools like Lovable, Bolt.new, Replit, Cursor and Claude Code get a working prototype built in a weekend. Getting it through a hundred real customers without leaking data, losing orders or falling over at 9am on a Monday is a different job. We diagnose what is actually wrong, then fix it or rebuild the parts that need it.
- Diagnostic in 3-5 days, £495
- Written verdict: fix, refactor or rebuild
- Fee credited against the rescue work
It shipped fast. Nobody checked what shipped.
A founder or an ops lead used an AI builder to get from idea to working app in days rather than months. It looked finished, so it went live. Then customers signed up, real money moved, and the cracks a demo never shows started to matter: another user's data on screen, a form with no server-side check, a database that falls over past a few thousand rows, an API key sitting in the browser for anyone to read.
This is not a criticism of the tools. Lovable, Bolt.new, Replit, Cursor and Claude Code are genuinely good at turning a description into working software fast. What they do not do on their own is the part that only matters once someone else is using the app: authorisation on every route, tests that catch a regression, backups that actually restore, monitoring that tells you something broke before a customer does.
Every builder fails in its own predictable way.
Not a criticism of the tool. A pattern we have seen enough times to name.
Lovable
Fast, opinionated Supabase apps where row-level security was never turned on. One user's data is often readable by any other logged-in user, because the default policy is open and nobody closed it.
Bolt.new
Client-heavy builds that call third-party APIs straight from the browser, keys included. Fine for a demo on one laptop, a liability the day a key gets scraped and billed against.
Replit
Apps that grew from a single Repl into real traffic, still on the free database tier with no backup schedule and no split between development and production.
Cursor & Claude Code
Larger codebases built fast with an AI pair programmer, often with no test suite. The code reads well; nobody can say what breaks when the next feature goes in.
The failures that do not show up in a demo.
Security
- Row-level security or tenant isolation left off
- API keys and secrets shipped in the client bundle
- Admin routes reachable without a real permission check
- No rate limiting on forms, logins or paid endpoints
Data
- No backup schedule, or backups nobody has tested restoring
- A schema that cannot hold the volume the business now has
- No migration history, so changes are made by hand in production
Operations
- No monitoring, so outages are reported by customers first
- No automated tests, so every change is a gamble
- One person holds every credential and nothing is documented
Not sure which of these fits? Twenty minutes on a call usually settles it.
Diagnose first. Fix second. Rebuild only where it earns it.
- 1
Diagnostic audit
Three to five days against your live codebase and infrastructure: security, data, auth, tests, hosting, cost and code quality, ending in a written fix, refactor or rebuild verdict.
- 2
Triage
We agree what must be fixed before real customers can trust the app, what can wait, and what should be rebuilt rather than patched again.
- 3
Fix or rebuild
Small apps are often fixed in place: holes closed, tests added, backups switched on, monitoring wired in. Where the foundations will not hold, we rebuild the weak parts in your own repository.
- 4
Handover
Documentation, credentials in your name, and a plain note on what changed and why.
Not sure which of these fits? Twenty minutes on a call usually settles it.
The same app, built to hold real users.
A rescued app is not necessarily rewritten from scratch. Often the product is right and the plumbing is wrong. We fix what is broken, keep what works, and tell you honestly which is which.
- Authorisation checked on every route, not just the ones a demo hit
- Secrets and API keys moved out of the client and into the server
- A database and hosting plan sized for the traffic you actually have
- Automated tests around the paths that lose money if they break
- Monitoring and alerts so you hear about a problem before a customer does
Who this is for, and who it is not.
A good fit
- An app built with Lovable, Bolt.new, Replit, Cursor, Claude Code or similar
- It works, mostly, but you would not bet the business on it
- Real customers, real payments or real data now depend on it
- Nobody in the business can say with confidence what is and is not secure
Not this, yet
- The app is still an internal prototype with no real users
- You want a from-scratch build with no existing code to assess, see AI App Development
- The issue is a single bug you already know how to fix
Not sure which of these fits? Twenty minutes on a call usually settles it.
The apps that fail are usually not badly written. They are unfinished in the ways a demo never tests: who can see what, what happens when the database gets busy, what happens when it breaks at 2am. That is the part we add.
Questions people ask before they book.
Do you rebuild everything from scratch?
Rarely. Most apps have a working product underneath and specific gaps in security, data handling or reliability. The diagnostic tells us which parts to fix and which are better rebuilt.
What if the diagnostic finds nothing serious?
That happens, and we say so in the report. You have then paid £495 for an independent second opinion and a written record for insurers, investors or your own board.
We built it with Cursor and it looks fine. Why would we need this?
Code that reads well and code that is safe with real users are different things. Row-level security, key handling and test coverage rarely show up from reading the app by eye.
Can you work with a vibe-coded app you did not write?
Yes. Most of our rescues are exactly that. We do not need the original builder involved, though it helps if someone can answer questions about intent.
How fast can this start?
The diagnostic is booked and run within days, because the risk is live while it waits. Fix and rebuild timelines are quoted once the report is in.
Do we own the code afterwards?
Yes. The app stays or moves into your own repository and hosting, with credentials in your name. We keep no special access once the engagement ends.
What does the fix or rebuild cost?
Fixes typically start at From £4,500. A fuller rebuild is quoted after the diagnostic, once we know the size of the real problem.
The other ways in.
AI App Diagnostic Audit
The standalone check, if you want the report before you decide anything about a fix.
£495AI Web & App Development
When the answer is a proper rebuild, built fixed price, fixed date, in your own repository.
From £4,500Legacy Software Modernisation
For older bespoke systems and spreadsheets rather than AI-generated apps.
From £2,500Find out what is actually wrong, in writing, in under a week.
Book a call, or go straight to the diagnostic audit. Either way you get a plain answer on whether to fix, refactor or rebuild.