AI-generated apps from Lovable, v0, Replit, Base44, Bolt, Cursor
Review generated code, authentication and data handling, then scope what is needed for a supported release.
Rescue a stalled software project or recover a compromised site.
We assess unfinished software projects and help teams recover compromised websites and applications. First, we establish what is working, what is at risk and what needs attention. You receive findings and a proposed plan before deciding on further work.
2015Building production software since
300Projects delivered
£2M+Processed by one platform
5.0Across 18 verified Clutch reviews
Technologies we work with.
Selected to fit your product, existing systems and delivery requirements.
Cloudflare
WordPress
Laravel
Node.js
Supabase
Docker
GitHub Actions
Sentry
Find the problem. Make a plan to fix it.
We help when a project has stalled, a prototype needs to become a supported product or a live system has been compromised. The first step is to establish what is there, the risks to your business and which work should come first. You receive findings and a practical plan before committing to the next phase.
Stalled builds from a previous team
Establish the current state, recover access and agree a prioritised plan to complete or stabilise the project.
Prototypes that need to become products
Keep the useful work and add the validation, error handling, monitoring and delivery process needed for launch.
Compromise recovery, malware and webshell removal
Contain identified threats, investigate the entry point and document remediation and follow-up checks.
Card-skimming and checkout integrity
Inspect checkout code, integrations and outgoing requests for unauthorised changes that can affect customer data.
Security and data-integrity reviews
Review access, updates, dependencies and recovery procedures to reduce operational and security risks.
A pre-raise or pre-acquisition audit
Review code and infrastructure with prioritised findings to inform an investment or acquisition decision.
See the work in practice
The brief, the build and what changed for the business.
01
Social eventsFour years across the app and operations
Mobile app, backend, advertising tools, a digital marketplace and website.
4+ yrssupport across five codebases
02
TravelA booking journey the tour team owns
A multilingual website connected to the booking API, with deposits, coupons and affiliate tracking.
6languages across the booking journey
03
Energy brokerageTenders, contracts and accounts brought together
Supplier tenders, contract management, brokerage accounting and client records.
100+suppliers per tender
How we assess and stabilise your system
You work with the same senior team from the first scoping conversation through to launch and support.
- 01
Audit / triage
A clear-eyed read of the code, the data model and — if it is live — what is actually running on it. You get the findings whether or not you continue with us.
- 02
Contain & stabilise
Address the highest risks first, with a containment plan for any active compromise or production failure.
- 03
Complete & verify
Finish agreed features, remediate identified issues and test the affected workflows, with a record of what changed.
- 04
Harden & support
Review tests, monitoring, backups and access controls, then agree follow-up checks and support responsibilities.
Know what’s fixed and what comes next.
We agree the scope with you before development starts.
Prioritised audit findings
What is safe, what is not, and what it would take to fix — in plain language.
Security and data integrity first
Prioritised work on authentication, permissions, validation and reliable data handling.
Root-cause investigation
We investigate the entry point, remove identified malicious access and document findings and remaining uncertainty.
Incomplete features and error handling
Auth edge cases, error states and the flows the prototype only pretended to handle.
Incident report and remediation record
What was found, where it came from, what changed — the document your processor, insurer or board needs.
Production infrastructure
CI/CD, monitoring and tested backup restoration are configured before handover.
Related rescue and security services
Explore the technologies, integrations and specialist work behind each build.
Sectors we serve
Where this work most often lands, and how it connects to the systems each industry runs on.
Clutch★★★★★5.0 / 5.0Across 18 independently published client reviews
“They have a deeper technical knowledge than any web designer I've met to date.”
Rescue & security guides
Field notes from real builds, on the decisions this work turns on.
PrismaPrisma 8 Is Out. We Audited 25+ Databases and the ORM Was Almost Never the Bottleneck
Prisma 8 lands with Postgres full-text search, multi-file schemas and prepared reads, but across 25+ database audits the ORM was rarely what made queries slow. Missing indexes, N+1 and over-fetching were. What Prisma 8 fixes and what it can't.
14 min readread →
AICopilot Code vs Claude Code vs Cursor: Who Ships to Production?
Microsoft's new Copilot Code turns a sentence into an app. We score it against Claude Code and Cursor on how far the output sits from production, using the Production Distance Index and our audit data on 31 AI-built codebases.
12 min readread →
AIAI Agents Are Leaking Data: What the OpenAI Incident Means Before You Deploy One
OpenAI paused its most capable models after agents escaped a sandbox over DNS, smuggled a GitHub token past secret scanning and posted 53 users' images to public hosts. What failed, why it is a permissions problem, and the Agent Blast Radius Index we use to contain it.
12 min readread →
Frequently asked questions
01Which AI-built codebases do you work with?+
Lovable, v0, Replit, Base44, Bolt, Cursor-generated projects and hand-rolled prototypes alike.
02Do I have to commit before the audit?+
No. The audit stands on its own — you get the findings and a plan whether or not you continue.
03Can you fix an app or site that is already live?+
Yes. We assess the live risks and stabilise the system. For a compromise, we use targeted containment where safe and explain when temporary downtime is necessary to protect users or data.
04Will you find how they got in, or just clean it?+
We investigate the entry point as well as removing identified malicious code and access. Findings, uncertainty and recommended follow-up checks are documented.
05How long does it take?+
An audit in days; stabilisation, finishing or full remediation typically 4 to 12 weeks depending on the state of things.
Let’s work out where things stand
Whether it is a prototype that needs finishing or a live system that needs recovering, the first step is an honest audit. Let's find the real state, close the risks, and build something you can put users and money through.