Head

Vibe Code Audit and Fixes, Fixed Price | AI Ship Captains

Free check for apps built with Lovable, Bolt, Replit or Cursor, then a £750 vibe code audit with a fixed price per fix. Every fix checked again, or refunded.

Hero

Vibe code audit and fixes

A senior analyst’s second opinion on everything your AI tool ships. We check your live app and fix what could hurt your users, at a fixed price, and every fix checked again, or refunded. Free check within one working day · Review £750 · A fixed price for each fix

Button: Ask for a free check

01 What you get

One review. Everything you need to fix it.

Every £750 review ends with a scorecard: a verdict you can forward, and your app scored out of 5 in eleven areas by a senior analyst. With it come the findings ranked and priced, a prompt for your AI tool for each, a rules file, the call, and a second check after the fixes.

• Security — Keys, sign-in and payments, rate limits on sign-in, the packages your AI tool added, and any AI feature in your app (prompt injection, and what its AI can reach): whether someone could read or change what isn’t theirs. Example: 2 / 5, weak. A Stripe secret key sits in the page code. To raise it: Move the key to a server function.
• Database — Row-level security, the shape of the data, indexes on the busiest tables, migrations, and whether a backup can be restored. Example: 2 / 5, weak. One table has no row-level security, the orders table has no index, and no backup has ever been restored. To raise it: Switch on row-level security, add the index, and test a restore.
• Compliance and privacy — The basics for a UK app: where personal data is kept, cookie consent, a privacy notice that matches what you do, how a customer’s data is deleted, and the ICO Children’s Code if your users may be under 18. Example: 2 / 5, weak. Personal data sits in three places, and there’s no way to delete one customer’s data. To raise it: List where the data lives and add a way to delete it on request.
• Architecture and scalability — How the app is put together, and what happens with ten times the users: what runs in the browser or on the server, slow queries, and the limits you’ll hit first. Example: 3 / 5, fair. Prices are worked out in the browser, and the orders page loads every order at once. To raise it: Work out prices on the server and load orders a page at a time.
• Code quality — Whether the code is readable and consistent, checks what users send, and carries no dead code, TODOs or half-finished refactors your AI tool left behind. Example: 3 / 5, fair. Three copies of the same form, nothing checks what users type, and an old payment flow is half removed. To raise it: Merge the forms, check the inputs, and remove the old flow.
• Verification and testing — Whether anything checks the app still works after a change: tests on sign-in, payments and the main paths, run before each release. Example: 1 / 5, at risk. No tests at all; every change is checked by clicking through by hand. To raise it: Tests on sign-in, booking and payment that run before each release.
• DevOps and infrastructure — Hosting, domains, certificates, environments, how a change reaches your users and how to undo it, and spending limits, including hard caps on AI model calls. Example: 3 / 5, fair. Managed hosting with HTTPS, but changes go straight to live with no way back, and no spending limit on the AI account. To raise it: A staging copy, a one-step rollback, and spending limits with alerts.
• Observability — Error alerts, logs and uptime checks: how quickly you’d know something broke, and why. Example: 2 / 5, weak. Nothing alerts you to errors, and logs are kept for a day. To raise it: Error alerts, longer logs, and an uptime check.
• Documentation — Whether you, a new developer or your AI tool can understand and change the app: a README, notes on how it’s set up, and a rules file your AI tool reads. Example: 2 / 5, weak. No README and no rules file, so each AI change can undo an earlier fix. To raise it: A short README and a rules file your AI tool reads before every change.
• Vendor independence — Whether you could move away from any one tool or supplier: who owns the code and the accounts (GitHub, domain, Stripe, hosting), whether your data exports, and the licences of what the app is built on. Example: 4 / 5, sound. The code and Stripe are in your name and the data exports, but the domain is registered to a freelancer’s account. To raise it: Move the domain into your name.
• Design and user experience — Whether the app is clear and easy to use on a phone, readable and accessible, and looks like your product rather than every other AI-built site, checked against Lookalike Check’s 41 patterns. Example: 3 / 5, fair. Text is too faint to read in places, and the first screen uses three common AI-template patterns. To raise it: Raise the text contrast and replace the template first screen.

Scored by a senior analyst against the same criteria for every app, not by a tool. This example is an illustration, not a real client’s app. Compliance and privacy covers the basics; it isn’t legal advice or a certificate.

Button: Why it matters

02 Why it matters

From vibe-coded to production-ready

AI tools get you to a working app in days. Making it safe for paying customers is a different job, and a vibe code audit is how you find out what’s left to do.

• The usual holes — Row-level security switched off. Keys left in the code. Sign-in that can be bypassed. Payment messages nobody checks.
• Your tool’s scan isn’t enough — Lovable, Bolt and Replit check for open data and leaked keys when you publish. They don’t look at payments, running costs, backups or monitoring, and their own documentation says the scans don’t replace a full review.
• What waiting costs — Add up what a week offline would cost you, or one email telling every customer their data leaked. Most fixes cost less.
• Bills that run away — Cloud and API costs rise with every user, and the first warning is the invoice.
• You don’t need a rewrite — Most apps need a short list of specific fixes, not a new app. You keep your app and the tools you built it with.

Button: Compare the options

03 Compare

Your tool’s scan, a scanner, or a review

Keep using your tool’s scan. Here’s what each option covers.

• Open data (Database rules switched off) — Your tool’s scan: Yes · An automated scanner: Yes · Our review: Yes
• Leaked keys (Secrets in your code) — Your tool’s scan: Yes · An automated scanner: Yes · Our review: Yes
• Payments (Stripe’s messages and refunds) — Your tool’s scan: Partly · An automated scanner: No · Our review: Yes
• Running costs (Limits and calls that grow with users) — Your tool’s scan: No · An automated scanner: No · Our review: Yes
• Backups (On, and possible to restore) — Your tool’s scan: No · An automated scanner: No · Our review: Yes
• Monitoring (Knowing before your users do) — Your tool’s scan: No · An automated scanner: No · Our review: Yes
• A person reads it (Ranked in plain English) — Your tool’s scan: No · An automated scanner: No · Our review: Yes
• The fix (Done, then checked again) — Your tool’s scan: Partly · An automated scanner: No · Our review: Yes

Based on the tools’ own documentation, October 2026. Lovable and Replit say their scans don’t replace a full security review.

Button: Meet the analysts

04 The people

The people who read your code

Not a bot, and not a junior reading a scanner’s output. Every check and review is done by a senior analyst you can name, look up and talk to, and the same person reviews your app, writes the report and takes the call.

• Maurício Ferreira — Founder · 20+ years in production. Designed, scaled and rescued software in production for 20+ years: at the BBC and, for ten years, at Visian Systems, a UK software house. Reads every request for a free check.
• André Derraik — Senior analyst · Principal Software Engineer · 30+ years. Python and Django, Go, Java and Spring, C and C++, and Node.js.
• João Gustavo — Senior analyst · Principal Software Engineer · 10+ years. Python, PHP, Ruby on Rails, Angular and Flutter.
• Edinaldo Sá — Senior analyst · Sr. Software Engineer & Architect · 16+ years. C# and .NET, Java, React and Angular, SQL Server and Azure.
• Video · WALKTHROUGH-01 — A senior analyst walks through a sample check on a demo app: their screen, their face in a corner, their own voice. Recorded by the analyst, never a client’s app without signed consent.

Button: See what we check

05 What we check

Ten checks, in plain English

The free check covers what any visitor’s browser can see. The review covers all ten.

• Secrets and packages — Keys left in your code, where anyone can copy them (payment keys, database master keys, AI keys), and packages your AI tool added that don’t exist, are out of date or have known holes.
• Database rules — Who can read and change your users’ data. In Supabase this is row-level security; in Firebase, your security rules.
• Sign-in — Whether protected pages and actions really are protected, whether one customer can reach another’s account, and whether repeated sign-in attempts are limited. Tested with two test accounts and an anonymous visitor, not assumed from reading the code.
• Payments — Whether Stripe’s payment messages are checked, and what happens on a failed payment, a refund or a cancelled plan, and that a payment message received twice is only counted once.
• Security settings — The protections your server should send with every page, and a certificate that’s set up properly.
• Personal data — What you collect, where it’s kept and who can see it, so you can answer a customer’s question about their data.
• Backups — Whether backups are on, and whether you could actually get your data back after a bad day.
• Running costs — Spending limits, including hard caps on AI model calls, and the calls that grow with every user, so the first warning isn’t the invoice.
• Errors and monitoring — Whether you find out about problems before your users do.
• Releases — How a change reaches your users, and how to undo it if something breaks.

We look only with your permission. Before any access we sign an NDA and a data agreement, and we remove our access and delete our working copies within 30 days of the report call. A review is not a penetration test or a compliance certificate; it’s a plain-English look at the things that most often go wrong. No review can guarantee an app will never be breached.

Button: See what we send you

06 A finding

What a finding looks like

Every finding in a review is set out the same way, so you can see what it means and what it costs to fix. This one is an illustration, not a real client’s app.

• Finding — A signed-in customer can read other customers’ orders.
• What we saw — The orders table has no row-level security. Signed in as a test customer, we asked the database for orders and received every customer’s, not just our own.
• What someone could do — Download every customer’s name, address and order history, using only their own login.
• Severity — Critical: fix this week.
• The fix — Turn on row-level security for the table and add a rule so each customer sees only their own orders. Then check the same request again.
• Effort and price — About two hours. Fixed price: set in your review.

[PROOF NEEDED: sample check] A full sample review, with the app’s name removed, will replace this illustration.

Button: See how it works

07 How it works

Three steps, a fixed price at each

You decide at each step. Nothing is sold before we’ve seen the problem, and every fix is checked again, or refunded. Step by step, below.

• The check · Free — You’ll know your three biggest risks; One page: the three most serious risks we can see from outside your app; Done by a senior analyst, with your permission; In your inbox within one working day. Yours to keep
• The review · £750 — You’ll know everything that needs fixing, and what each fix costs; Delivered within five working days; Ten checks, with access to your code, database and hosting; Every finding ranked, in plain English, with a fixed price for each fix; Access rules tested with two test accounts and an anonymous visitor, not assumed from reading the code; A scorecard: your app scored out of 5 in eleven areas, from security to design; A rules file for your AI tool (AGENTS.md or CLAUDE.md), ready to commit, so it follows what the review found; Money back within seven days of the report call if you’re not happy with the review; A 30-minute call to go through it; About two hours of your time in total: the NDA, setting up access, and the call; Fixes for most apps come to £3,000 to £6,000 in total; your £750 comes off that if you go ahead within 30 days. Fix prices hold for 30 days, and if a fix takes us longer, that’s our cost
• The fix · Fixed price — You’ll have the fixes you chose, done and checked; Delivered in one to three weeks, depending on the list; A fixed price for each fix, set by the review: pick the ones you want; We work on a copy, and nothing goes live without your approval; Done by our engineers, then checked again, included in the price; A handover: a note on what changed, prompts for your AI tool, and a rules file it reads before every change, so it doesn’t undo the fixes; A free follow-up check 30 days later

Our guarantee: if an item on the agreed list fails our second check, we fix it within 10 working days or refund that item’s price. This covers the code as we handed it over, not changes made after handover, and our total liability is capped at the fees you paid.

We don’t promise income. We promise things you can check: a safer app, lower running costs, fewer surprises.

Button: Ask for a free check

08 Questions

Questions

• How is this different from Snyk, SonarQube or CodeRabbit? — They’re automated tools, and good at what they do: Snyk looks mostly at the packages your app depends on, SonarQube at code quality, and CodeRabbit reviews each change before it’s merged. Keep using them if you do. A review adds a senior analyst who looks at how your live app behaves, from database rules and payments to backups and costs, ranks what matters for your business in plain English, and fixes it at a fixed price.
• Can I keep building with AI afterwards? — Yes. You keep your app and your tools. The review comes with a rules file your AI tool reads before each change, so it follows what the review found, and every fix adds a note on what changed, so the tool doesn’t undo it.
• How soon can you start? — The free check is in your inbox within one working day of your request. A review takes five working days from the day access is set up, and we’ll give you a start date when you ask for it.
• What is in the vibe code audit scorecard? — A verdict you can forward (ready, ready with conditions, or not yet) with the three reasons behind it, then eleven areas, each scored out of 5 by a senior analyst: security, database, compliance and privacy, architecture and scalability, code quality, verification and testing, DevOps and infrastructure, observability, documentation, vendor independence, and design and user experience. Each score comes with the reason and what would raise it. It’s part of the £750 review.
• Is this for my app? — Yes, if your app is live and people pay for it, or soon will; you built it with Lovable, Bolt, Replit, v0, Cursor, Claude Code or something like them; and you want to keep your app and your tools. It isn’t for you if you’re still looking for an idea, want a new app built from scratch, or want guaranteed income: we make your app safer and cheaper to run, and don’t promise what it will earn.
• How much does a vibe code audit cost? — The first check is free. The full review is £750, with a fixed price for each fix it finds; most fixes come to £3,000 to £6,000 in total, and the £750 comes off if you go ahead within 30 days.
• Is Lovable safe for production? — Lovable can run a production app, and it scans for common problems when you publish. Its own documentation says that scan doesn’t replace a full security review. What matters is how your app was set up: its database rules, keys, payments and backups.
• Is Supabase safe for production? — Yes, when it’s set up properly. The usual problem isn’t Supabase but a table left without row-level security, or a secret key placed where the browser can see it.
• What does “RLS disabled in public” mean? — It’s a Supabase warning that a table has no row-level security, so anyone with your app’s public key may be able to read or change it. On a table with customers’ data, it’s usually the first thing to fix.
• My tool already scans my app. Why do I need this? — Keep using the scan. It catches open data and leaked keys. It doesn’t look at payments, running costs, backups or monitoring, or see your app the way a stranger does. That is where we look.
• Should I fix my app or rebuild it? — Usually fix it. Most apps need a short list of specific fixes, done in your app, with your tools. If a rebuild really would be cheaper, the review says so.
• Do I need to know how to code? — No. Everything is in plain English, with what to tell your AI tool if you’d rather make a fix yourself.
• Which tools do you cover? — Lovable, Bolt, Replit, v0, Cursor, Claude Code and tools like them, plus the services they run on, such as Supabase, Firebase, Vercel and Stripe. See the full list of tools we review.
• What access do you need? — None for the free check. For the review, read access to your code, database and hosting, after an NDA and a data agreement. We remove our access and delete our working copies within 30 days of the report call.
• What does the free check look at? — Only what any visitor’s browser receives, and only after you’ve said yes.
• How long does it take? — The check reaches you within one working day, the review within five working days of access being set up, and a fix takes one to three weeks, depending on the list.
• What if a fix doesn’t hold? — We fix it within 10 working days or refund that item’s price. This covers the code as we handed it over, not changes made after handover.
• Is my app GDPR compliant? — The review checks what personal data your app collects, where it’s kept and who can see it, which is most of what UK GDPR asks of a small app. We’re engineers, not lawyers, so we’ll tell you if something needs legal advice.
• Is this a penetration test? — No. A review is a plain-English look at the things that most often go wrong in apps built with AI. If you need a penetration test or a certificate, we’ll say so.
• Is there a community? — Yes. AI Ship Captains is a community for founders who run apps built with AI. It’s closed to new members for now; you can register interest on the community page.

Button: Ask for a free check

09 Start

You built the ship. Now captain it.

Start with a free check of your app: one page, three findings, yours to keep. Tell us about your app.

• Your app’s address — And what it does, in a line.
• What you built it with — Lovable, Bolt, Cursor or similar, and where it’s hosted.
• Who pays for it — Roughly how many paying users, and what it brings in a month.
• What worries you most — The thing that keeps you up, if anything.

The form posts to the site’s server, which passes the request to n8n (N8N_CHECK_REQUEST_WEBHOOK_URL).

Button: Ask for a free check

Footer

shipcaptains.ai · @aishipcaptains · Contact: Stapeley House, London Rd, CW5 7JW, Nantwich, United Kingdom · Badges: Cyber Essentials Certified, ICO Registered, Powered by Visian Systems