Skip to content
Thorfyn
pt

AI prototype · production

Your Lovable, Bolt, v0 or Bubble app, taken to production.

The prototype proved the idea. Real users found what it skipped: access rules, integrations, cost and load. We take it the rest of the way, in your accounts.

Send us your app

A link to the app is enough to start. Read access to the repository helps, if there is one.

Built inLovableBoltv0Bubble

When an AI-built app stops holding up

Four signs that the prototype has reached its limit.

From an AI-built prototype to production

Real users arrived and the builder stopped helping. We take it to production, in your accounts.

  1. Diagnosis

    2,400USD, one week paid

    One week on the code you have. A written report, one recommendation.

  2. You choose

    Harden or rebuild. The decision is yours.

  3. The work

    Each delivery has a preview; publishing waits for your approval.

  4. In your accounts

    Repository and cloud in your name. You leave whenever you want.

diagnosis · your-appDemo data

A one-week report

What the diagnosis hands you

findings
6
days of work, in the example
8.5
recommended path
Harden
  • What we saw.
    The public API returns the customer list with no credential.
    Effect.
    Anyone downloads the personal data of every customer.
    Fix.
    Turn on row-level access rules and test with and without signing in.
  • What we saw.
    The key appears in the bundle the browser downloads.
    Effect.
    Anyone who opens the inspector can use the payments account.
    Fix.
    Replace the key and move the call to the server.
  • What we saw.
    Every change from the generator goes live at once.
    Effect.
    A generator mistake takes the app down for every customer.
    Fix.
    A test environment, minimal tests and an approval before production.
Recommended path. The choice is yours.

In the diagnosis we only read the code. Nothing changes in your app.

Read the full sample reportSix findings, one recommendation

Why the diagnosis starts with access rules: CVE-2025-48757 records apps generated by an AI builder whose database tables could be read and written without signing in. The record at NVD

What stays yours

The builder held your app. Nothing we do holds it again.

Read how it works

Guides and engineering notes, each with the source behind its figures.

Questions about taking a prototype to production

How much does the diagnosis cost?

2,400 USD, the price of the discovery week, because it is the discovery week applied to the app you already have. It ends in a written report with one recommendation. A smaller question, such as speed or cost per user, fits the fixed-price audit.

Do you need access to my code?

A link to the app is enough to start. Read access to the repository helps, if there is one: the diagnosis reads the code and the data.

Harden or rebuild: who decides?

You do. The report recommends one path in writing. Harden keeps the stack and closes the holes; rebuild moves to a standard stack built to reach a million users.

Will I be locked in to you instead of the builder?

No. Code, repositories and cloud accounts are created in your name; we get access, not ownership. Every engagement keeps an exit package current.

Why does the diagnosis start with access rules?

Because CVE-2025-48757 records apps generated by an AI builder whose database tables could be read and written without signing in. Access rules are the first thing the diagnosis reads.

Send the app as it is.

A link to the app is enough to start. Read access to the repository helps, if there is one.

Send us your app

hello@thorfyn.com

Everything else Thorfyn builds and runs