For apps built in Lovable, Bolt, v0, Cursor

Your app works in preview. We’ll make it survive production.

$49 async audit. Severity-ranked PDF. No call. You send a zip or a GitHub URL; you get a report a mechanic would actually use.

Start a $49 audit See a real sample report
0 clients so far. First 10 audits are $49, and that $49 is credited if you continue to a $297 single-issue triage on the same app. I would rather tell you that than invent testimonials.

A mechanic, not another builder

You already have an app. The generator got you a preview URL that logs in and shows a table. Production is a different job: keys, policies, webhooks, DNS, env. I read the tree, rank what will hurt, and either hand you the report or patch the thing you name.

01

Read the source

A static scanner plus a human pass. File:line evidence. No login to your Stripe account required for the audit.

02

Rank the breaks

P0 leaks data or money. P1 fails for real users. P2 is hygiene. The report says which SKU matches the pile, not “book a strategy call.”

03

Patch what you buy

Triage is one issue. The Production Pass is the paid path in 72 hours. The kit is if you want to turn the wrenches yourself.

Three services, one backup SKU

Pay for a report, a single fix, or a 72-hour pass. The kit sells even if I am asleep.

You already know the break

$297 one issue

Single-issue triage

You name it: OAuth, webhook, RLS, white screen, domain, mail. I patch that issue and send notes. Not a rewrite, not automated.

  • Patch + PATCH_NOTES.md
  • What I did not touch, listed
  • 3 business days, unless DNS is waiting on your registrar
  • First 10: $49 audit credited on the same app
Buy $297 triage

Must take payment this week

$497 72 hours

Production Pass

Secrets, RLS on the paid path, Stripe webhook, OAuth redirects, Vercel env, a smoke-test payment. Written notes. Not automated.

  • Need GitHub (or a zip you will apply)
  • Need you or me to click Vercel / Stripe / Supabase
  • Clock starts when I can actually run the app
  • No UI redesign, no new features
Buy the $497 pass

Sells with no client comms

$39 download

Production Hardening Kit

A zip: 15-item checklist, GitHub Action that greps for service_role, RLS SQL that uses auth.uid(), Stripe webhook stub, Vercel env sheet, Resend DNS sketch. You copy files in. No account access, no call.

The file lives at dist/shipready-hardening-kit.zip once this repo is on a host. Buy it here: eldarrealty.gumroad.com/l/cfnjnz.

Buy the $39 kit

Intake is email. The form is a backup.

Pay on Gumroad. Audit: $49. Kit: $39. After the audit, reply to the receipt with a zip (no node_modules) or a GitHub URL.

Subject line — “Audit”, “Triage: [issue]”, “Production Pass”, or “Kit”.
Attach or link — zip of the app, or a GitHub URL. Production URL if it exists.
Wait for the report — 24h on audits. I will not book a call to “scope” a $49 job.

This stores the note in localStorage. If you run python3 site/server.py, it also appends site/intakes.json. It does not charge a card and it does not send the zip.

The breaks, written up so you can fix them yourself

Each page is the actual fix, not a teaser. Pay $49 if you want it run against your tree.

RLS off (or USING true)

The anon key can read every row. How the generators get here, and the SQL that actually closes it.

service_role in the client

If it is in src/, it is in the browser. Rotate, then stop prefixing it with VITE_.

Stripe webhook, no signature

Why fetch('/api/webhook') from React is a free-upgrade button, and the constructEvent stub.

Vercel white screen

Localhost is fine, production is blank. It is almost always a VITE_ var that never got into the build.

OAuth still on localhost

Google 400s on the *.vercel.app URL. Where to put the redirect, in which three dashboards.

Custom domain / certificate

The 12-click version, plus why Chrome still says Not Secure after you “added the domain.”

Resend DNS / mail in spam

SPF, DKIM, DMARC sketched so you know what good looks like at your registrar.

Vercel env: public vs secret

What may start with VITE_ / NEXT_PUBLIC_, and what must never.

A sample report, from a fixture that is supposed to fail

I planted a service role in the client, USING (true) RLS, an unsigned Stripe webhook, localhost OAuth, and a committed .env full of FAKE_ keys, then ran the same scanner you would get. No invented customers.

Open the sample audit

What the $49 does not include

  • I do not log in to your Vercel/Stripe unless you buy triage or a pass and grant it.
  • I do not rewrite features or restyle the UI.
  • I do not call you. If the zip will not build, I say so in the report.
  • Payments on this site are not wired. Email is the checkout for now.

Questions worth answering once

Why $49 if you have zero clients?

Because the scanner exists and a report takes an evening, not a week. The first ten are also a credit toward triage so early buyers are not punished for going second. When the calendar fills, this price will move.

Do I have to use Lovable?

No. Bolt, v0, Cursor, and hand-written Vite/Next apps hit the same production walls. The copy names Lovable and Bolt because that is where the preview-vs-production gap is sharpest.

Will you sign an NDA?

For a $49 audit, send a zip without production live keys (rotate if they are already in git — they are already leaked). For a Production Pass, a one-page NDA is fine. I will not countersign a vendor packet longer than the job.

Is the kit a substitute for the audit?

If you like checklists, yes. If you want file:line evidence on your tree, buy the audit. They stack: kit for the repo defaults, audit for what is already wrong.