Built it with Lovable, Bolt, Replit or v0?
A security warning, a migration that will not apply, a bug that keeps coming back, or an investor asking how solid it is. Give me one read-only day in your repo and I will tell you exactly what is open and what it costs to close. Fixed price. You keep building.
Free. If your app fits, the £550 day follows once it is paid.
You built it yourself, it has users or revenue, and you do not want a rewrite. You want the holes closed, the schema under control, and the confidence to keep prompting without reopening them.
Building with Cursor or Claude Code and shipping every day? The retainer is for you: it installs the conventions and gates so the next prompt cannot reopen a hole.
See the retainerOne day. One report. Then a fixed price to fix it.
For £550 ($750) I spend one day inside your repo and your Supabase project, read-only, and hand you a report that says exactly what is load-bearing and how well each piece is protected:
The report ends with a fixed total for the fixing work. Your £550 comes off that total if you go ahead. If you do not, you still have the report and a roadmap you can hand to anyone.
Report within two working days of access. Read-only.
£550/$750
One read-only day inside your repo and your Supabase project. Report within two working days of access.
£4,500/$6,000
Up to ten days on the set that matters, shipped as reviewed pull requests while you keep building. The £550 is credited.
Priced by what it closes, not by the day. If it takes fewer than ten days, the time left goes on the next items from your report. If the day shows the app needs more than ten days, you get a separate fixed quote before anything starts.
£3,000/$4,000
per month
For founders building with Cursor, Claude Code or a no-code builder who want the guard-rails to stay up. It installs:
Larger apps quoted up to £4,000.
Prices in GBP and USD, excluding VAT, which is added for UK customers. EUR on request.
Paid in pounds or dollars, whichever your card is in. Invoice in the same currency.
Twenty minutes, free. You tell me what is worrying you and I check your app fits the day. If it does, I send a payment link for £550 ($750); if it does not, I say so. Then read-only GitHub and Supabase access, and the day starts once it is paid.
One day inside the repo and the database. If I find a live exposure I tell you immediately, before the report, at no extra charge.
Within two working days of access you get the report and a fixed total for the fixing work, with the £550 credited if you go ahead.
Fixes go in as reviewed pull requests while you keep using your builder. The sprint leaves you the guard-rails so the next prompt cannot reopen the hole.
The most recent rescue in detail, and the same work on the Next.js stack. The rescue took a founder-built app from open tables and leaked secrets to tested, migration-gated production, without stopping the founder building. Thirty years of the same kind of work follows.
30
years since the first rescue
226
pull requests merged in six weeks on the newest
0
rewrites. Every app kept its own codebase
Day one: enabled RLS, revoked anonymous grants, purged a committed env file and rotated its keys, baselined the production schema into migrations, moved the model calls server-side. Then a row-level-security test suite, mutation testing on the tests themselves, and a per-call quota chokepoint.
Every change landed as a reviewed pull request.
Turning a hand-built schema into versioned migrations applied by CI on every merge, with workflows pinned by SHA. Server-side authentication and rate limits on routes that had none.
Every change landed as a reviewed pull request.
My own systems, so you can see how I build:
I have been the person called in when the system matters and the people who built it have gone since 1995. The rescue above is the newest; it is not the first.
A customer-communications system in Visual Basic and undocumented C++, the original developers gone. I made it maintainable, built a sane way to extend it, introduced source control, and trained the team so they never needed me again. Senior management wrote to thank the team.
Nineteen years on train ticketing under ISO 9001, including eight as a senior developer on WebTIS, the ticket-selling site used by East Coast, First Group and other operators, selling several million pounds of tickets a day, with an immovable launch date. Three of us also built a demonstration system in four weeks that won a multi-million-pound contract.
Seven years designing and building the platform, a C# microservice back end, an Angular site and a mobile app, for children with learning difficulties, built to the US HIPAA privacy rules from the first commit.
Its platform, Xamarin, had reached end of life. Moved to .NET MAUI on .NET 10, with GitHub Actions pipelines building and shipping to both app stores, a test suite where there was none, and a token that was leaking into error logs stopped. Delivered with the same reviewed-pull-request loop I use on every rescue.
Conveyancing integrations for Connells Group on Azure with Terraform and queues, a flight-school app that records training outcomes and takes payment through Stripe, and my own AI products on Azure.
Microsoft Certified Solution Developer since 2002. B.Eng. in microelectronics, Newcastle. Private pilot for twenty-five years, which is where I learned that checklists beat confidence.
The audit is read-only. Fixes only happen after you accept a written quote.
No. You keep using your builder. The fixes go in as reviewed pull requests, and the sprint leaves you with the guard-rails so the next prompt cannot reopen the hole.
Then you have a report that says so, with the evidence, which is what an investor or acquirer will ask for.
No. The first step is a free twenty-minute call. If your app fits the day I send a payment link for £550, and the day starts once it is paid. If it does not fit, I tell you on the call.
If the day finds a live exposure, I tell you immediately with the exact policy or key rotation, before the report, at no extra charge. Closing it is a ten-minute job you can do yourself, or I can do it for a fixed quote.
A free kickoff call to check your app fits. Then one read-only day inside your repo and your Supabase project, a report within two working days, and a fixed price to fix what matters, with the £550 credited.
Calls in UK and European hours, and in US hours from East Coast mornings to Pacific evenings.