I make AI‑built appssafe to launch.

For founders who built their app with Lovable, Bolt, Cursor, v0, or Replit and need to know if it's ready for real users.

Book the $250 review
$250
Review to start
2–3 days
To a written verdict
Fixed
Prices. No hourly billing.

Sound familiar?

You built it. Now you're not sure
you trust it.

  • “A user emailed me a screenshot. It was someone else’s data.”

  • “People are using the paid features. Stripe says they never paid.”

  • “Every fix breaks something else. I’ve stopped touching it.”

  • “I have no idea if it’s secure. I just know it works when I click around.”

  • “I tried to hire a developer. They looked at the code and said no.”

None of this means you built the wrong thing. It means nobody has checked the parts you can't see.

When people book

The moments this gets booked

  • An investor’s technical advisor is about to look at your code.

  • The launch date is fixed and nobody else has read the code.

  • An enterprise customer just sent a security questionnaire.

  • Your first developer hire starts soon and will take over the code.

The review

What I actually look for

Every review covers the same list. Here it is in plain language, with what happens if it's wrong.

Secrets in the browser

Your private keys are inside the app itself, where anyone who looks can copy them, run up your bill, or read your data.

Users who can see each other’s data

The rules about who can see what are missing or wrong. One user can read, change or delete another’s records by changing a number in the address bar.

Payments taken on trust

Your app believes anything that says it’s from Stripe. People get paid features without paying.

Forms that accept anything

The app takes whatever it’s given. That’s how bad data gets in, and how attackers do.

Silent failures

Errors are hidden instead of handled. Things break quietly and you find out from a customer.

Slows down as you grow

Fine with ten users. Timeouts with a thousand.

Building blocks nobody checked

AI tools pull in code libraries that were made up, abandoned, or already known to be unsafe.

No tests

Nothing tells you something broke until a customer clicks on it. And the code changes every time a tool touches it.

AI with no guardrails

No written rules, so every session guesses again. That’s how an app ends up with seven ways of doing the same thing.

Each one has its own page, with a 30-second check you can do yourself. See all nine.

Services

Three fixed-price options.
Start with the review.

01

Production Readiness Review

$250 · 2–3 business days

A recorded walkthrough of your app’s code and a written report with every problem ranked by how serious it is. You get a clear verdict: fix, restructure, or rebuild.

  • Recorded walkthrough of the code
  • Written report, every problem ranked by how serious it is
  • Verdict: fix, restructure, or rebuild
  • Fee credited toward the next tier

If your app is in good shape, the report says so and the call is short. Spend the money on customers instead.

02

Hardening Sprint

From $3,000 · 1–2 weeks

The known problems, fixed. One price, agreed before work starts.

  • Private keys taken out of the app and kept where users can’t reach them
  • Rules for who can see what, enforced and tested
  • Payments checked properly, so nobody gets in without paying
  • Error handling and automated tests around sign-in, payments, and the thing your app is for
03

Rescue & Refactor

From $5,000 · Scoped after the review

For apps that need restructuring before they can grow. Delivered in approved phases, so work can stop at any phase boundary.

  • Reorganising the code and how your data is stored
  • Written documentation and a proper handover
  • A written rulebook for your AI tools, so they stay on the rails after the work is done
  • Built so you or a future hire can continue

Already launched? A monthly review retainer covers ongoing checks as your app changes. The rulebook is kept current, and new AI-generated work is reviewed against it. Ask about it on the call.

How it works

Three steps.
No open-ended billing.

  1. Book the review

    Pay $250, give me access to the code, and get a written report within 2–3 business days.

  2. Get the verdict on a call

    We go through the findings together. You’ll know what’s wrong, what matters, and what doesn’t.

  3. Decide with fixed prices in hand

    If there’s work to do, you get a fixed quote. Take it, get a second opinion, or hand the report to someone else. No hourly billing.

Production Readiness ReviewIllustrative sample

Verdict: Fix.

Safe to launch after one Hardening Sprint. No rebuild needed.

  • criticalMaster database key inside the app
  • highAny customer can read any other customer’s records
  • highPayment confirmations accepted without checking they’re real
  • mediumCheckout errors hidden from the user
  • lowDashboard will slow to a crawl as data grows

Recorded walkthrough · Written report · Verdict call

About

The person auditing
is the person fixing.

I'm Aaron. I have a computer science degree and a background in building mobile apps and web apps, front to back. I work solo, so the person who reads your code, writes the report, and explains it on the call is the same person who fixes it.

Judgement first
You’re paying to know what’s wrong and what it costs to fix. The typing is the easy part.
Direct line
You talk to me. Every reply, every fix.
Fixed prices
Quoted before work starts. No surprises on the invoice.

Proof

Two apps, built with
the same tools.

Teardown

An AI-built farm management app

What it was built with

One HTML file. Markup, styling and all the logic in a single page, with an online database plugged in and deployed by dragging the file onto a free host.

What I found

The database address and key were written into the file, so every copy of the app pointed at the same database and anyone who viewed the page source had the key. The database was set to let that key read, change and delete everything, including another farm’s records. Admin access was a PIN checked on the user’s own device, which anyone can get around. The whole farm was saved as one lump, so two people saving at once meant one person’s entries disappeared. In eight of the thirteen places meant to catch errors, nothing happened, so a failed save looked like a successful one. No tests, and nothing checked the numbers staff typed in.

What it would have cost

Anyone with the file could have read or wiped the farm’s records. Staff would have lost mortality counts and feed logs without knowing. And because nobody knew who owned the database account, the leaked key could never be revoked.

What fixing it involved

The verdict was rebuild, not patch. The prototype became the reference for a new build: each farm’s data walled off from every other farm’s, and tested to prove it; every change going through a server that checks who’s allowed; a permanent record of every entry so nothing is silently overwritten; and a tool to bring the old data across.

Build

ShiftMark

ShiftMark is an app for Ontario long-term care homes. Staff ask a question about the home's own policies in plain language and get the answer back, with the exact document it came from. The same app keeps track of required training and fills open shifts across the Greater Toronto Area, first with the home's own staff and then with nurses and care workers from the marketplace. Aaron Haizel built it and runs it, with the same AI coding tools his clients use. After four months of continuous work, new features still go in without breaking old ones: the policy assistant was added in August to an app people were already using, and the rest kept working.

  • Who can see what

    Every request is checked on the server: who you are, what your role is, and whether you belong to the home you’re asking about. The database has its own rules on top, so a mistake in the app can’t hand one home’s records to another. Those rules have tests that run on every change.

  • Personal data

    Licence numbers and uploaded documents sit in private storage that only opens with a short-lived link. Logs are scrubbed of keys and tokens, and email addresses are masked. Admin actions go into a record that can’t be edited afterwards. Users can download their data or delete their account. Keys and secrets live in a vault, not in the code.

  • Checking who shows up

    Credential checks are done by a person, against the document on file, before a professional is accepted. Required training is enforced before anyone can apply to a shift. Arrival and departure are confirmed with four-digit codes from both sides, so the record isn’t one party’s word against the other’s.

  • Catching mistakes before customers do

    Hundreds of automated tests run every time the code changes, against a real database. If any of them fails, the change can’t go in. That’s how a feature could be added in August without breaking what shipped in June.

  • Keeping the AI on the rails

    Both codebases have a written rulebook the AI tools read at the start of every session, plus automatic checks that run after every edit. The tools work inside those rules instead of guessing.

Now in beta, with sign-ups open for facilities and professionals. Same tools as the apps I review. The difference is that every session started from written rules, and every change went through tests before it went in.

FAQ

Common questions

Permission to read your code, nothing more. I don’t need the ability to change it, and I don’t need access to your live database.

Yes. Send yours, or I’ll send a short mutual one.

The report is yours. Take it to another developer, get a second opinion, or do nothing. You paid for the review, not for me.

No. I read the code and the settings. If something needs checking against live data, I’ll ask you to run a specific check and tell me what you see.

The tools change. The problems don’t. If it’s a web or mobile app with a database and users, I can review it. If I can’t, I’ll say so before you pay.

The review is paid when you book. Sprints and rescues are fixed quotes, paid half up front and half on delivery, or per phase for a rescue.

I delete my copy within 30 days of delivering the report, unless you’ve booked follow-up work. The recorded walkthrough is yours to keep.

Get started

Find out before
your users do.

Book the Production Readiness Review. $250, 2–3 business days, and a clear verdict you can act on.

Questions first? Email ahaizel@akhaizel.ca
Based in Canada · Works remotely

Production Readiness Review

$250 · 2–3 business days
  • Recorded walkthrough of your app’s code
  • Written report, every problem ranked by how serious it is
  • A verdict on a call: fix, restructure, or rebuild
  • Fee credited toward the next tier
Book the $250 review