Your team's vibe-coded app works. Is it ready for production?
Someone on your team built a useful app with Lovable, Replit, Bolt, Cursor or Claude Code. Maybe it was you. Before employees or customers depend on it, it needs three things AI tools rarely provide: security, room to grow, and someone accountable for keeping it running. I'm a software engineer with 13 years of production experience. I find what's missing, fix what matters, and look after it.
I take on two clients at a time. Both spots are open.
Why AI-built apps need a second look
of 200 audited AI-built apps had at least one security vulnerability.
Deng, Fan and Meng, 2026of 307 CTOs, CIOs and CISOs are very confident they can see every internal tool running in production.
Retool, State of AI Governance 2026of those leaders have no clear owner when an AI-built tool causes an incident.
Retool, State of AI Governance 2026It started with one workflow. I built a tool that moved purchasing data from Procurify into Sage 50, doing the work of five full-time junior accountants. After seeing that, the finance director bet fully on AI. He spent two months of evenings and weekends with Claude building a replacement for the company's purchasing and accounting software. It worked. It would save tens of thousands of dollars a year. Then someone asked who else could log in, where the data was backed up, and what happens when he's on vacation.
That's the moment this service is for. The app isn't bad. It was built to prove an idea, and now it has to survive real people, real data and real mistakes. That takes a different set of skills from the ones that got it working.
Why vibe-coded apps fail in production
Anyone can probe it
Organizations with full IT departments still get breached. In August 2026, attackers stole the personal information of 350,000 people from Quebec's construction commission (La Presse). An app built over a few weekends has no security team at all.
It works on a laptop
It's fast with fifty test rows. Will it hold up with your whole database, a year of history, and your entire team logging in on Monday morning? Slow pages and timeouts usually show up the same week everyone starts relying on the app.
Who answers the tickets?
The person who built it had time that weekend. Will they have time in two weeks, when their real job is busy, leadership wants a change, and customer tickets start piling up?
Security, scale and upkeep. That's the part I take off your plate.
The vibe-coded app checklist
Twelve questions an AI-built app should pass before employees or customers depend on it. Tick what's true today. Your answers stay on this page unless you choose to send them to me.
Who can get in
Your data
When it breaks
When it changes
Vibe code audit, hardening and ongoing care
Every engagement starts with the audit. You decide what happens next.
Two clients at a time. Alongside my own projects, I take on two clients at a time, and each gets dedicated time. Right now, both spots are open.
Production-readiness audit
I review your app's code, hosting and data handling against the checklist above, plus the details it doesn't cover. You get a written report in plain language: what's risky, what can wait, and what it would take to fix.
A page from a real audit. Identifying details removed. Side project
$2,000 USD- Report in 2 business days
For side projects and internal tools getting ready for real users.
Critical application
$4,000 USD- Report in 4 business days
For apps that handle sensitive customer data or need to scale to millions of requests a day.
Fixed price, agreed before I start. If you go ahead with hardening, the audit fee is credited toward it.Hardening
I fix the gaps from the audit: sign-in and permissions, backups, monitoring, secure hosting, tests. I keep your app and the way you built it. This isn't a rewrite unless you ask for one.
All the work happens in your own GitHub and hosting accounts. The code is yours, not mine.
Scoped from the audit, fixed price per milestoneOngoing care
A monthly retainer: I watch the alerts, apply updates, review the changes you and your AI tools make, and answer the "is this safe?" questions as they come up.
More importantly, I tell you about problems before they happen. Security gaps, an app that will slow down as your team grows, code that will be hard to change next year: you hear it from me first, with a plan, instead of reading about your app on the front page of the New York Times.
Side project
From $2,000 USD / month- Reply by the next business day
- Up to 8 hours a month
For side projects going to the next level, from 0 to 50 customers.
Critical application
From $4,000 USD / month- Reply within 4 business hours
- Up to 20 hours a month
For critical apps that handle sensitive customer data and need regular audits and more.
Cancel any time
Who you'd be working with
Heri Rakotomalala
Software engineer · Quebec, Canada · English and French
I work with clients across Canada and the US. I've spent 13 years keeping business-critical systems running, including a trading platform for private-company shares and the core operations system of Canada's largest venue of its kind. I build with AI tools every day, so I know what they do well and where they quietly cut corners.
In 2012 I co-organized Montreal's first Startup Weekend, where teams built a company in 54 hours. I told La Presse that only about 30% of Startup Weekend projects are still running six months later. AI tools have made the weekend part easy. The six months after it are still the hard part.
Frequently asked questions
Is vibe coding safe for production?
It can be, for the right app. Internal tools and early products built with AI can run safely in production once the basics are in place: proper sign-in and permissions, secrets kept out of the code, backups, monitoring and tests. The risk comes from skipping that layer, which AI tools rarely add on their own. The checklist above covers it.
How much does a vibe code audit cost?
$2,000 USD for a side project or internal tool, with a report in 2 business days. $4,000 USD for a critical application that handles sensitive customer data or needs to scale, with a report in 4 business days. Both are fixed price, and the fee is credited toward hardening if you go ahead.
Will you tell me to throw it away and start over?
Rarely. In my experience, most AI-built apps have a sound core and a missing layer around it. I'll only recommend a rebuild if fixing would cost more, and I'll show you the numbers.
I'm not technical. Will I understand the report?
Yes. It's written for the person who owns the risk, not for engineers. Each finding says what could happen, how likely it is, and what fixing it costs.
Do you work with apps built in Lovable, Replit, Bolt, Cursor or Claude Code?
Yes. I work on apps built with Lovable, Bolt, Replit, v0, Cursor, Claude Code and GitHub Copilot, in Python, TypeScript, Elixir and Ruby, with the usual databases and cloud hosts. If I'm not the right fit, I'll say so on the first call.
You're one person. What happens when you're away?
You work directly with me: no account managers, and no juniors learning on your app. I work Monday to Friday, Eastern time, and I tell you about time off weeks in advance. I won't pick up the phone on December 25, so part of my job is making sure you never need me to: alerts, a written runbook, a tested rollback, and documentation good enough that another engineer could take over tomorrow. That's the last item on the checklist, and I hold my own work to it.
Do you work in French?
Oui. I work in English and French, and I am based in Quebec (here's an interview I gave to Les Affaires, in French). I've often worked with teams on the US East and West Coasts, as well as in Japan and Singapore.
Tell me what your team built
Wherever you are in Canada or the US, a short call is enough to know whether an audit makes sense. No preparation needed; just bring the app. I take on two clients at a time, in the order they book.