Studio Zenkai

Your AI-built app works on your laptop. Is it ready for your company?

You built something useful over a few weekends with Lovable, Bolt, Replit, Cursor or Claude Code. Before your team or your customers depend on it, it needs three things AI tools rarely give you: security, room to grow, and someone to keep it running. I'm a software engineer with 13 years of production experience. I'll find what's missing, fix what matters, and look after it so you don't have to.

Book a 20-minute call Check your app first

I take on two clients at a time. Both spots are open.

It started with one workflow. I built a tool that moved purchasing data from Procurify into Sage 50, doing the work of five full-time junior accountants. After seeing that, the finance director bet fully on AI. He spent two months of evenings and weekends with Claude building a replacement for the company's purchasing and accounting software. It worked. It would save tens of thousands of dollars a year. Then someone asked who else could log in, where the data was backed up, and what happens when he's on vacation.

That's the moment this service is for. Your app isn't bad. It was built to prove an idea, and now it has to survive real people, real data and real mistakes. That takes a different set of skills from the ones that got it working.

Three ways a weekend app lets you down

Anyone can probe it

Organizations with full IT departments still get breached. In August 2026, attackers stole the personal information of 350,000 people from Quebec's construction commission (La Presse). A weekend app has no security team at all, and researchers who audited 200 AI-built apps found flaws in 91% of them (study).

It works on your MacBook

It's fast with fifty test rows. Will it hold up with your whole database, a year of history, and your entire team logging in on Monday morning? Slow pages and timeouts usually show up the same week everyone starts relying on the app.

Who answers the tickets?

You had time this weekend, even enough to find it a good name and make it look polished. Will you have time in two weeks, when you're buried in your real job, your boss wants a change, your team needs help, and customer tickets start piling up?

Security, scale and upkeep. That's the part I take off your plate.

Is your app ready for real users?

Tick what's true today. Be honest: your answers stay on this page unless you choose to send them to me.

Who can get in

Your data

When it breaks

When it changes

How I can help

Every engagement starts with the audit. You decide what happens next.

Two clients at a time. Alongside my own projects, I take on two clients at a time, and each gets dedicated time. Right now, both spots are open.

  1. Production-readiness audit

    I review your app's code, hosting and data handling against the checklist above, plus the details it doesn't cover. You get a written report in plain language: what's risky, what can wait, and what it would take to fix.

    A page from an audit report on a family activity app. It scores 2 of 12 checklist items met, 4 partly met and 6 not met. Finding 1, critical: family photos can be downloaded by anyone, because they are stored at numbered addresses with no sign-in. How likely: high. Fix: random file names served only to signed-in family members, about 1 to 2 days.
    A page from a real audit. Identifying details removed.

    Side project

    $2,000 USD
    • Report in 2 business days

    For side projects and internal tools getting ready for real users.

    Critical application

    $4,000 USD
    • Report in 4 business days

    For apps that handle sensitive customer data or need to scale to millions of requests a day.

    Fixed price, agreed before I start. If you go ahead with hardening, the audit fee is credited toward it.

  2. Hardening

    I fix the gaps from the audit: sign-in and permissions, backups, monitoring, secure hosting, tests. I keep your app and the way you built it. This isn't a rewrite unless you ask for one.

    All the work happens in your own GitHub and hosting accounts. The code is yours, not mine.

    Scoped from the audit, fixed price per milestone

  3. Ongoing care

    A monthly retainer: I watch the alerts, apply updates, review the changes you and your AI tools make, and answer the "is this safe?" questions as they come up.

    More importantly, I tell you about problems before they happen. Security gaps, an app that will slow down as your team grows, code that will be hard to change next year: you hear it from me first, with a plan, instead of reading about your app on the front page of the New York Times.

    Side project

    From $2,000 USD / month
    • Reply by the next business day
    • Up to 8 hours a month

    For side projects going to the next level, from 0 to 50 customers.

    Critical application

    From $4,000 USD / month
    • Reply within 4 business hours
    • Up to 20 hours a month

    For critical apps that handle sensitive customer data and need regular audits and more.

    Cancel any time

Who you'd be working with

Heri Rakotomalala

I'm Heri Rakotomalala, a software engineer working with clients across Canada and the US. I've spent 13 years keeping business-critical systems running, including a trading platform for private-company shares and the core operations system of Canada's largest venue of its kind. I build with AI tools every day, so I know what they do well and where they quietly cut corners.

In 2012 I co-organized Montreal's first Startup Weekend, where teams built a company in 54 hours. I told La Presse that only about 30% of Startup Weekend projects are still running six months later. AI tools have made the weekend part easy. The six months after it are still the hard part.

99.9% uptimeon the operations system I own today
SEC-registeredtrading platform I worked on as lead engineer at Nasdaq Private Market
25x throughputafter redesigning a critical integration
5 people's workautomated by a Procurify-to-Sage 50 integration I built

Questions

Will you tell me to throw it away and start over?

Rarely. In my experience, most AI-built apps have a sound core and a missing layer around it. I'll only recommend a rebuild if fixing would cost more, and I'll show you the numbers.

I'm not technical. Will I understand the report?

Yes. It's written for the person who owns the risk, not for engineers. Each finding says what could happen, how likely it is, and what fixing it costs.

What tools and languages do you work with?

I work on apps built with Lovable, Bolt, Replit, v0, Cursor, Claude Code and GitHub Copilot, in Python, TypeScript, Elixir and Ruby, with the usual databases and cloud hosts. If I'm not the right fit, I'll say so on the first call.

You're one person. What happens when you're away?

You work directly with me: no account managers, and no juniors learning on your app. I work Monday to Friday, Eastern time, and I tell you about time off weeks in advance. I won't pick up the phone on December 25, so part of my job is making sure you never need me to: alerts, a written runbook, a tested rollback, and documentation good enough that another engineer could take over tomorrow. That's the last item on the checklist, and I hold my own work to it.

Do you work in French?

Oui. I work in English and French, and I am based in Quebec (here's an interview I gave to Les Affaires, in French). I've often worked with teams on the US East and West Coasts, as well as in Japan and Singapore.

Tell me what you built

Wherever you are in Canada or the US, a short call is enough to know whether an audit makes sense. No preparation needed; just bring the app. I take on two clients at a time, in the order they book.

Book a 20-minute call