Ship It Live — $1,999 flat
Design + build + deploy · kickoff in 24h · limited slots
Ship It Live · production sprint
You vibe-coded a prototype. I'll make it survive real users.
AI got you to something that works on your laptop. That last 20% — auth that holds, a database strangers cannot read, and a deploy that does not need you awake — is what this sprint is for.
Quick answer
A vibe-coded prototype — built with Cursor, Claude Code, Lovable, Bolt or Replit — can be taken to production in about 21 days from a fixed $1,999. The work is usually not rewriting it: it is securing the database, fixing auth, adding tests and making it deployable by someone other than the person who prompted it.
The plan
Day one to day 21, written down.
You get this schedule before you commit, not after. If a phase slips, that is mine to absorb — the price and the date were agreed before anything started.
- 1
Days 1–3
Audit
I go through what you have built and write down what is genuinely broken, what is risky, and what is fine. You get that document whether or not you continue.
- 2
Days 4–8
Security first
Database rules, auth, exposed keys. AI tools reliably get these wrong because a prototype that works and a prototype that is safe look identical from the outside.
- 3
Days 9–15
Make it hold
Error handling, edge cases and tests around the paths that matter. The difference between a demo and something you can leave running.
- 4
Days 16–19
Deployment
A proper pipeline, environments, monitoring and backups — so a deploy is a command rather than an evening.
- 5
Days 20–21
Handover
Walked through what changed and why, with the code left in a state another developer can pick up without archaeology.
What from $1,999 gets you
Everything needed to launch — nothing padding the invoice.
Who books this
Built for
Founders whose AI-built prototype suddenly has real users on it
Non-technical builders who got far and then hit a wall they cannot see
Teams who need a security and quality pass before anyone pays for this
Real situations
Five ways this shows up, and what actually fixes it.
Not hypothetical — the shape of the problem before someone books this sprint, and the specific part of the build that resolves it.
Situation 1
The prototype works on a laptop, then real users show up
A founder built a working product with Cursor or Lovable, shared it with early users, and now has real signups and real data flowing through something that was never designed to hold either.
A written audit in days 1-3 identifies exactly what's genuinely broken versus merely risky, before any work starts on fixing it.
Situation 2
Got far, then hit a wall that isn't visible
A non-technical founder pushed an AI coding tool impressively far on their own, but has now hit issues — errors that make no sense, things that work sometimes — that they have no way to diagnose themselves.
The audit surfaces what's actually wrong in plain language, whether or not the engagement continues past that point.
Situation 3
A prototype that quietly has open database access
An AI-built app looks and works fine from the outside, but nobody has checked whether its database tables are readable or writable by anyone who finds the right URL — the single most common serious flaw in vibe-coded apps.
Days 4-8 go straight to database access rules and authentication — the security pass AI tools reliably skip because a safe prototype and an unsafe one look identical.
Situation 4
About to charge money on a codebase nobody has stress-tested
A team is ready to start charging real customers on a product built entirely through AI prompting, without anyone having reviewed what happens when a payment fails or a user does something unexpected.
Tests are added specifically around the paths that would cost money if they broke, before the security and quality pass is called done.
Situation 5
Worried the whole thing needs to be thrown away
A founder assumes their AI-built prototype is too messy to save and is bracing for a full rebuild quote instead of an honest assessment.
Most AI-built prototypes are structurally fine and specifically insecure — the audit says which one this is, with reasons, rather than defaulting to the bigger, more expensive answer.
The honest part
When 21 days is the wrong answer.
A fixed deadline only works when the scope genuinely fits inside it. These are the cases where I will tell you so rather than take the booking.
Prototypes where the underlying idea has not been tested with users. Hardening something nobody wants is an expensive way to learn that.
Codebases so tangled that rebuilding is genuinely cheaper — I will tell you honestly if that is what I find in the audit.
Products needing formal compliance certification, which is a programme rather than a sprint.
Inside the 21 days
- A written audit of what is actually wrong, before any work starts
- Database access rules — the most common serious flaw in AI-built apps
- Authentication and session handling reviewed and fixed properly
- Secrets moved out of the client and into somewhere safe
- Tests around the paths that would cost you money if they broke
- A real deployment pipeline, so shipping is not a manual ritual
- The code left readable, so the next developer is not stuck
- 30 days of post-launch support, included
Quoted as one number before day one. A week running long is mine to absorb.
Outside the line
- Prototypes where the underlying idea has not been tested with users. Hardening something nobody wants is an expensive way to learn that.
- Codebases so tangled that rebuilding is genuinely cheaper — I will tell you honestly if that is what I find in the audit.
- Products needing formal compliance certification, which is a programme rather than a sprint.
Real work, sized and priced separately. You hear it before you book, not at handover.
Questions
Before you book
Building software by prompting an AI rather than writing the code yourself — a term coined by Andrej Karpathy in 2025. It genuinely works for getting to a prototype fast. Where it struggles is the unglamorous production layer: access rules, auth, error handling and deployment, because those failures are invisible until someone exploits or hits them.
Other sprints
21 days from now, this could be live.
A 30-minute call decides whether the scope fits. If it doesn't, I'll tell you what would.