Built with AI. Breaking with users.

What any AI prototype does well

AI generators solve the problem that used to kill ideas: getting to something real before the money or the enthusiasm ran out. That's not a small thing, and the answer is not to start again by hand. The gap is that every one of them optimises for the first working version, and the difference between that and production is almost entirely in what happens when things go wrong.

• A modern JavaScript framework
• A managed database, configured through a dashboard
• Third-party APIs called from the client
• A single deployment, no staging
• No test suite and no CI

• 01

  It assumes the happy path

  Generated code handles the flow that was demonstrated. Network failures, partial writes, duplicate submissions and concurrent edits are unhandled, and each becomes a support ticket that's hard to reproduce.

• 02

  The security model is the UI

  Access is controlled by what's rendered rather than what's authorised. Every endpoint has to be assessed on its own, because the frontend's opinion about who can do what has no force.

• 03

  Cost has no ceiling

  Where the app calls an LLM or a metered API, there's no per-user limit, no caching and no circuit breaker. A retry loop or a scraper turns into an invoice.

• 04

  Change is frightening

  With no tests, no migrations and no staging, every deploy is a gamble. Teams slow down to compensate, which is what makes a fast-built product feel stuck.

• 01

  Secrets in the client bundle

  API keys inlined into frontend code because the prototype had no server to hide them behind. Anyone can read them with view-source, and rotating them is the first thing we do.

• 02

  Authorisation checked in the UI

  The admin button is hidden from non-admins, and the endpoint behind it is wide open. Hiding a control is not access control, and this is the single most common serious finding.

• 03

  No migration history

  The schema exists because someone clicked through a dashboard. There's no record of how it got that way and no safe path to change it, so the first production schema change is terrifying.

• 04

  Nothing to catch a regression

  No tests, so the next AI-assisted edit that breaks checkout is discovered by a customer. This is what makes generated codebases feel fragile — not the code quality, the absence of a safety net.

1. 1

   Audit — 3 to 5 days

   Every file read. Exposed secrets, authorisation gaps, cost traps, data-loss risks and dead code, ranked by severity, with a fix-or-rewrite recommendation per area. Yours whether or not you continue.

2. 2

   Foundation

   Real auth with server-side enforcement, a schema captured as versioned migrations with row-level security, real payments, and secrets managed properly across environments.

3. 3

   Tests and CI

   Vitest and Playwright over the paths that would hurt, running in GitHub Actions on every pull request — so the next AI-assisted change reports what it broke.

4. 4

   Production

   Staging and production, Sentry, uptime monitoring, alerting, and cost guards on anything metered. Mobile-responsive and PWA-ready where it matters.

5. 5

   Handover

   Documented codebase, runbooks, and a 30-day support window. Keep building with us, or hand it cleanly to your own team — both are normal endings.

1. Step 1 · Validate

   30-day Sprint

   Prove the use case before you commit. Working prototype on real data, eval scores, and an honest signal in 30 days. Fixed scope, fixed fee.

   $4,500 fixed

   Learn more
2. Most teams land here

   Step 2 · Build

   Prototype → Production

   Turn the validated prototype into a real product. Auth, DB, payments, tests, monitoring, deployed. Sprint fee credits toward this engagement.

   from $6,000

   Learn more

3. Step 3 · Scale

   Managed Retainer

   Ongoing operation, eval cycles, model iteration, and cost guards. We keep the system improving so your team can focus on growth.

   from $750/mo

   Learn more

FAQ

AI Prototype to Production: your questions.

• Which tool did you say you support?

  All of them, because the findings barely differ. Bolt, Lovable, v0, Replit and Cursor have their own dedicated pages with tool-specific detail; anything else goes through the same audit and lands in the same place.

• What if the prototype is genuinely unsalvageable?

  We say so, in writing, with the reasoning — and roughly a third of the time a rewrite of the data layer is genuinely cheaper than repairing it. The audit exists to make that a decision rather than a discovery three months in.

• What's the 30-day guarantee?

  If we scope a 30-day sprint and miss the delivery bar for reasons within our control — our team, our timeline, our capacity — the engagement is free. It's in the contract, and it's about delivery rather than a promised business outcome.

• Do we own everything?

  From day one: the repo, the IP, and the right to take it elsewhere. No lock-in, no proprietary runtime of ours in your stack.

• Bolt to ProductionBolt gets you to a running product in an afternoon. We add the things it never had to think about — real auth, migrations, payments that can't double-charge, and a test suite that survives your next prompt.Read
• Lovable to ProductionLovable is very good at producing an app that looks and feels finished. What it can't know is which of your tables must never be readable by another customer — and that's the finding that stops enterprise deals.Read
• v0 to Productionv0 output is the best-looking starting point in the category, and it is almost entirely frontend. The work is building the system underneath it — and doing that without throwing away the UI you liked.Read