Hamza Zulquernain · Vibe-Code Rescue
Your app worked. Until it didn't.
You built something real with an AI builder, and it got you further than anyone expected. Then it stopped getting closer. I audit AI-built apps and tell you what's wrong, what it costs to fix, and whether it really needs the rewrite someone told you it needs.
For apps built with Lovable · Bolt.new · Replit · v0 · Cursor · Base44 · Bubble
Sound familiar?
You're not imagining it, and you're not alone. In early 2025, a quarter of one Y Combinator batch had codebases that were about 95% AI-generated. Many apps hit the same wall. It has a shape, and the shape is predictable.
- It works on your screen and breaks on someone else's.
- Every new feature quietly breaks two old ones.
- You're not sure whether users can see each other's data.
- Something went wrong with a payment and you don't know why.
- The AI keeps rewriting files it shouldn't touch.
- You've been told it "needs a rewrite" and don't know if that's true.
- You want to hire a developer but can't tell a good one from a bad one.
- It got to about 70% and then stopped getting closer.
What usually breaks
The same six things, almost every time. AI builders share the same models and the same default settings, so they fail in the same places. Here is what I look for, roughly in the order I find it.
Your database is readable by anyone
In Supabase, a table created in code has Row Level Security off until someone turns it on, and AI builders don't always do it. With it off, the key in your app's front end can read every row: every user, every record. It is a widely reported problem, and often a quick fix once someone points it out.
Sign-in checks that live in the browser
Hiding a page in the app is not the same as protecting it. If the check happens in the browser and not on the server or in a database policy, anyone can skip it by calling the server directly. Generated code does this often, because it looks right in a demo.
Secret keys shipped to the browser
Service-role keys, Stripe secret keys and other API tokens end up in code that ships to the browser. Anyone can see them in the browser's developer tools. Once a key is public, rotating it is part of the fix, not the whole of it.
Payments that double-charge or silently fail
Stripe webhooks need signature checks and protection against repeats. Generated code often has neither. A retried webhook charges twice, and a failed one leaves an order paid but not recorded. You usually find out from a customer.
A data model that blocks your next features
The data model gets shaped by whatever the opening prompt needed. It works until you add teams, roles or history. Then every new feature needs a change nobody planned for. That is usually what "it needs a rewrite" means.
The same logic copied ten times
Studies of AI-assisted code have found far more copy-pasted code than before. Nothing is broken exactly, but a one-line change now has to be made in ten places, and you will miss one. This is what makes the app feel like it fights you.
The rescue audit
5 days. A written answer. Yours either way.
You give me read access to the code and ten minutes on what the app is meant to do. You get back a report written for someone who doesn't code.
What you get
- A written report in plain language, with no jargon and no assumed background.
- Security findings ranked by how bad they are, with what to do about each.
- A verdict on your database design: fine, needs work, or needs replacing, and why.
- A review of the payment flow if you take money: webhooks, retries, refunds, edge cases.
- What breaks under real traffic, and roughly at what point.
- A fix list in order of priority, with an honest cost and time estimate for each item.
- A straight answer on whether it needs a rewrite. Usually it does not.
How it works
- Share accessYou give me read access to the code and spend ten minutes on what the app is meant to do.
- ReviewI read the code. I check security, the data model, payments, and how it holds up under real traffic.
- ReportYou get a report in plain words. It ranks what I found by how bad it is, with a fix list and honest costs and times.
- DecideYou keep the report and choose what's next. Hire me for the fixes, take it to another developer, or do it yourself.
You keep the report whether or not you hire me to do the fixes.
Taking it to your own developer is a fine outcome. It saves them a week of finding their way around, and you choose your next step with real information instead of a sales pitch. Either way, you don't pay and walk away with nothing.
What it costs
Fixed fees, published. Rescue work runs $1,000 to $10,000 across the market, and full rebuilds run $25,000 to $50,000. Anyone quoting you a rebuild before reading the code is guessing.
Rescue Audit
$1,500
5 business days
You need to know what you're actually dealing with.
- Full review of the code and settings
- Security, database, payments, stability
- Written report with fixes in order of priority
- Honest cost and time estimates
- Yours to keep, with or without me
Audit + Fix
$4,500
2 weeks
You want the dangerous things gone, now.
- Everything in the Rescue Audit
- Critical security issues fixed
- Payment handling made correct
- Deployed and checked in production
- Handover call and written notes
Rescue Build
from $12,000
4–6 weeks
It needs to become real software.
- Everything in Audit + Fix
- Architecture rebuilt where it has to be
- Tests around the parts that matter
- Monitoring, so you find out before customers do
- Full GitHub handover and IP assignment
The audit fee is credited against the fix or build if you go ahead. Scope is confirmed on a call before anything is invoiced.
Who owns the code
You own all of it, in writing.
The code goes into a GitHub account in your name, and the contract assigns the IP to you. If we stop working together, you keep the code, the report, the hosting and the accounts. You can hand all of it to any other developer without asking me.
Ask every agency you talk to about this, not just me. Not owning your code is a common way new founders get stuck, and it is much easier to settle before the work starts than after.
Who you work with
One person, and you talk to him. There is no account manager and no offshore team. The person who reads your code writes the report and does the fixes.
Hamza Zulquernain
Fractional CTO · Zapp Studios · Houston
Based in Houston, working with owners here and remotely.
I take pride in this work, and I stay with it after it ships. The job is done when your business gets real value from it and your team can run it.
- Founding engineer, DietAIBuilt the product, the funnel and the growth systems through a 7-figure exit.
- Equity partner, Royal Pawz USA12× monthly revenue by month six.
- Two back-office systemsBuilt with the owners and their teams, and handed over in 2026.
Rescue audits are a newer line of work for me than building software from scratch. So judge me by the report. It is written for you to keep, whatever you decide.
Questions founders ask
How much does it cost to fix an AI-built app?
A fixed-fee audit is $1,500 and takes five business days. Audit + Fix is $4,500 over two weeks and deals with the critical issues. A full rescue build, where the architecture has to change, starts at $12,000 and takes four to six weeks. Across the market, rescue work usually lands between $1,000 and $10,000. A ground-up rebuild from an agency more often runs $25,000 to $50,000. A rescue build costs less than that because it keeps whatever is already sound instead of starting again. If someone quotes you a rebuild before looking at the code, get a second opinion.
Does my app really need a full rewrite?
Usually not. Most AI-built apps have a few serious problems, like weak security settings, a shaky data model or unsafe payment code. The rest is repetitive, but it works. Replacing everything is the expensive answer, and often the wrong one. The audit tells you which parts need replacing and which just need tidying.
I'm not technical. How do I know if a developer is any good?
It is a fair question, and a hard one. Three things help. Ask them to explain one specific problem in your app in words you understand; if they can't, that tells you something. Pay for a small, scoped piece of work before a large one. And make sure whatever you buy leaves you with something you keep, like a written report or code in a repository you own. The audit is built to be that kind of low-risk first step.
Do I own the code?
Yes, all of it. Code goes into a GitHub repository you own, with the IP assigned to you in writing. If you stop working with me, you keep everything, including the report, and you can hand it to any other developer. Some agencies keep the code in their own accounts, so ask about it before you sign anything, with me or anyone else.
Which AI builders do you work with?
Lovable, Bolt.new, Replit, v0, Cursor, Base44 and Bubble. Also most anything built in JavaScript or TypeScript with a Postgres or Supabase database behind it. The problems are much the same across tools, because they share the same models and the same default settings.
Can you just tell me if it's safe to launch?
That is mostly what the audit answers. If you are about to put the app in front of real users, and especially if it stores personal data or takes payments, the security and payments sections matter most. I look at those before anything else.
What do you need from me to start?
Read access to the code or your builder project, and a live URL if it is deployed. Plus about ten minutes of your time to explain what the app is meant to do. You don't need to write documentation or clean anything up.
Why did this happen? Did I do something wrong?
No. AI builders are good at getting you to a working prototype quickly, and that is a real achievement. They are tuned for the part that demos. The rest is security, data modelling, error handling and edge cases. That is a different skill, and mostly invisible until it fails. Ending up here is the normal result of moving fast, not a mistake.
Find out what you're dealing with.
A 30-minute call, no charge. Bring the app and whatever you've been told about it. If the audit isn't the right next step, I'll say so.