# Your Lovable, Bolt, v0 or Bubble app, taken to production.

Canonical URL: https://thorfyn.com/en/ai-prototype-to-production

> Your Lovable, Bolt, v0 or Bubble app found real users and stopped holding up. A one-week diagnosis, then harden or rebuild, in your own repository and accounts.

The prototype proved the idea. Real users found what it skipped: access rules, integrations, cost and load. We take it the rest of the way, in your accounts.

Built in: Lovable, Bolt, v0, Bubble.

## When an AI-built app stops holding up

Four signs that the prototype has reached its limit.

- **Data anyone can read** — Tables and files open to anyone with the URL, because access rules were never written.
- **Integrations that break** — Payments, email and webhooks that fail quietly or run twice.
- **A bill that grows faster than users** — Builder credits and queries nobody tuned, priced per request.
- **A ceiling on load** — Pages that slow down as soon as more people use them at once.

## From an AI-built prototype to production

Diagnosis: 2,400 USD, one week paid. One week on the code you have. A written report, one recommendation.

- **You choose** — Harden or rebuild. The decision is yours.
- **Harden** — Keep the stack, close the holes.
- **Rebuild** — Standard stack, built to reach a million users.
- **The work** — Each delivery has a preview; publishing waits for your approval.
- **In your accounts** — Repository and cloud in your name. You leave whenever you want.

What the diagnosis hands you (Demo data): Critical — Tables readable without signing in; High — Secret payment key in the browser code; High — Release straight to production, no tests.

Why the diagnosis starts with access rules: CVE-2025-48757 records apps generated by an AI builder whose database tables could be read and written without signing in. The record at NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-48757

## What stays yours

The builder held your app. Nothing we do holds it again.

- **Yours from day one** — Code, repositories and cloud accounts are created in your name. We get access, not ownership.
- **You leave whenever you want** — An exit package kept current with every delivery: architecture, how to operate it and the handover of access.
- **Nothing that locks you in** — Standard, open tools only. Your product keeps running without us.

## Read how it works

- [Is your AI-built app leaking data?](https://thorfyn.com/en/notes/is-my-ai-built-app-leaking-data): The four Supabase checks to run before launch, how to run each one yourself, and what a failure means.
- [How to take a Lovable, Bolt or v0 app to production](https://thorfyn.com/en/notes/lovable-bolt-v0-app-to-production): What breaks when real users arrive, the order to fix it in, and how to tell when rebuilding costs less than hardening.
- [From Bubble to code without taking the app offline](https://thorfyn.com/en/notes/bubble-to-code-migration): Cost per user, speed and lock-in: how to read each one, and a migration one part at a time.

## Questions about taking a prototype to production

**How much does the diagnosis cost?** 2,400 USD, the price of the discovery week, because it is the discovery week applied to the app you already have. It ends in a written report with one recommendation. A smaller question, such as speed or cost per user, fits the fixed-price audit.

**Do you need access to my code?** A link to the app is enough to start. Read access to the repository helps, if there is one: the diagnosis reads the code and the data.

**Harden or rebuild: who decides?** You do. The report recommends one path in writing. Harden keeps the stack and closes the holes; rebuild moves to a standard stack built to reach a million users.

**Will I be locked in to you instead of the builder?** No. Code, repositories and cloud accounts are created in your name; we get access, not ownership. Every engagement keeps an exit package current.

**Why does the diagnosis start with access rules?** Because CVE-2025-48757 records apps generated by an AI builder whose database tables could be read and written without signing in. Access rules are the first thing the diagnosis reads.

## Send the app as it is.

A link to the app is enough to start. Read access to the repository helps, if there is one.

- Email: hello@thorfyn.com
- Founded by Matheus Pavaneli
- One operation slot open for the next cycle
- Brazil · working async
- The reply comes within one business day.
- Everything else Thorfyn builds and runs: https://thorfyn.com/en