From almost works to launched.
Your AI-built app, secured, finished and launched. Fixed price.
Secure checkout via Stripe · Refund policy
Founding rate $290 · first 5 clients- Works with
-
-
-
-
-
-
-
-
Illustration: a mountain range drawn in text characters, with a flag planted on the highest summit.
The problem
Almost works is the expensive part.
- Demo works, production does not
- Real users, real money, real data
- No one has read the code
Illustration: an unfinished highway bridge, its two sections not yet joined.
- 01
“It's 80% done. The last 20% won't move.”
> The easy parts are generated. The hard parts need decisions.
- 02
“Every fix breaks something else.”
> Duplicated logic and no tests, so each prompt fixes one copy.
- 03
“I can't read my own code anymore.”
> Thousands of lines no one has reviewed.
- 04
“Payments go through, but nothing updates.”
> Stripe webhooks missing, unverified or failing quietly.
- 05
“Anyone can read my database.”
> Row-level security off, or too open on key tables.
Launch Audit scope
What I check.
Seven areas where AI-generated apps break once real users and real money arrive. I read the code and the configuration by hand, then test the flows.
Illustration: a stack of balanced stones.
- 01
Row-level security and authorization
Can user A read or change user B's data? I check every table policy and every API route, not just the ones the UI calls.
Supabase · RLS - 02
Auth flows
Sign-up, login, password reset, email change, session expiry, OAuth redirects and role checks, in production, not just on localhost.
Sessions · OAuth - 03
Exposed secrets
API keys in the client bundle, in the repo history or in public env files. Service keys that should never leave the server.
Keys · Env - See all 7 checks
Sample report
What you get back.
Every finding has a severity, the fix and what changes after it. The audit finds them, a Sprint fixes them. This sample uses a fictional demo app, so you can see the format before you buy.
Audit report · demo-app
sample Fictional demo app, used to show the format. Not a client.
Lovable · Supabase · Stripe
Illustration: a beetle, as in a bug found in the code.
- 2 critical
- 1 high
- 1 medium
- 1 low
-
Profiles table readable by anyone
- Before
- RLS disabled on public.profiles. The anon key returns every row, including emails.
- Fix
- Enable RLS. Add select and update policies scoped to auth.uid() = id.
- After
- Anon select returns 0 rows. Users only see their own profile.
-
Webhook accepts unsigned events
- Before
- The webhook handler trusts the request body. A forged event can mark an order as paid.
- Fix
- Verify the Stripe signature. Store event ids and skip duplicates.
- After
- Forged events get a 400. Replays are ignored.
- See all 5 findings
Pricing · USD
Fixed prices. Published.
Start with the audit. Everything after it is scoped and quoted before I start, so the price never moves.
Illustration: an ibex standing sure-footed on a cliff ledge.
- 00
Free Teardown
A 5 to 10 min recorded review of your live app's public surface.
- Screen recording with voice-over
- What a stranger can see and break from the outside
- Max 5 per week
Free
48h
- 01 Start here
Launch Audit
A full review of your repo and backend before real users and real money touch it.
Fee credited 100% toward a Sprint booked within 14 days.
- Row-level security and authorization
- Auth flows, secrets, Stripe and webhooks
- Deploy, CI, backups and architecture
- Prioritized findings with severity
- A fixed quote for the fixes
$490
3 business days
- 01b
Quick Fix
One defined blocker, fixed and deployed.
- Agreed scope before I start
- Fix deployed to production
- Short note on what changed
$750
3 business days
Buy · $750Secure checkout via Stripe · Refund policy
After the audit
Quoted from the audit findings, so the price is fixed before I start.
- Fix & Launch Sprint from $2,500 1–3 weeks
- Care from $750 per month
- MVP Build from $8,000 4–6 weeks
- Due-Diligence Audit $1,500 For funded startups
The audit guarantee
If the audit doesn't find at least 5 concrete, actionable issues, it's free.
Illustration: a calm sea drawn in text characters, slowly moving.
Portrait of Badii Boutar, drawn in text characters.
About
Built with AI. Finished by an engineer.
I'm Badii Boutar, a senior full-stack engineer with 7+ years of experience. I work alone, so the person you talk to is the person who does the work.
I led a platform migration for Clyso, a German tech company, added AI features to 1000cookbooks, and built Peeps, one of the most popular apps on Overwolf. I also built my own e-commerce platform that ran live stores with checkout and payments.
I use Claude Code every day. That's how I know where AI-generated code breaks: auth and session edge cases, missing row-level security, unverified Stripe webhooks, leaked keys and the same logic written three times.
- 12 Companies since 2019
-
-
-
-
-
-
-
-
-
-
-
-
- Built with
-
-
-
-
-
-
-
- Location
- Tunisia · CET (UTC+1)
- Online
- 09:00 to 20:00 CET
- Overlap
- Full EU day · US East Coast mornings
- Billing
- Registered business · USD or EUR invoices
How I work with your code
Safe to say yes.
Illustration: a bee gathering pollen on yellow flowers.
- 01
Fixed scope
You know what is included and what it costs before I start.
- 02
Code stays in your GitHub
I work in your repo, on branches you can review.
- 03
IP assigned on payment
Everything I write for you is yours once the invoice is paid.
- 04
Read-only access first
The audit needs read access only. Write access comes later, if at all.
- 05
NDA on request
Ask, and I sign one before you share anything.
FAQ
Questions.
Illustration: a statue of a seated man, deep in thought.
01 Do you need my passwords?
No. I never ask for your personal logins. You invite me as a collaborator on GitHub and your backend, with the lowest access that works. For the audit, that is read-only.
I only get write access when we start fixing, and you can remove it at any time.
02 What do you need from me to start?
For the audit: a read-only invite to your code (GitHub) and to your backend (for example your Supabase project), plus a few lines on what the app does and what worries you.
No passwords. Anything else I need, I ask by email.
03 What if my app isn't built with Lovable or Bolt?
That is fine. The audit covers web apps on a modern JavaScript or TypeScript stack, such as React, Next.js, Node.js, Supabase, Firebase or PostgreSQL, whether they were written by hand or with any AI tool.
Not sure your stack fits? Email me before you buy and I will tell you.
04 Lovable already scans my app. Why do I need this?
Built-in scanners are a good first pass. They look for known patterns. They do not know your business rules: who should see which rows, what happens when a Stripe webhook arrives twice, or whether a reset link works in production.
I read the code and the configuration by hand and test the flows that matter for your app.
05 Will you rebuild my app?
No, not by default. I fix what you have. If part of it cannot be saved, the audit says so and explains why, with a price, before any work starts.
06 Who owns the code?
You do. The code stays in your GitHub, and all IP is assigned to you once the invoice is paid.
07 What happens after launch?
Every Sprint ends with a handover doc, so you or another developer can take over. If you want me to keep it running, a monthly Care plan covers monitoring, backups, updates and fixes.
08 How do payments work?
Audits are paid 100% upfront. Sprints are 50% to start and 50% at launch. Care is billed monthly in advance. MVPs are paid 30% / 40% / 30%.
Payments are processed by Stripe, and show on your card statement as BADII.STUDIO. Invoices are issued by Pan African Center for Entrepreneurship, in USD, EUR on request. Refunds follow the refund policy at badii.studio/refunds.
09 What time zone are you in?
I am based in Tunisia, CET (UTC+1), and online 09:00 to 20:00 CET. That is a full overlap with Europe and the morning on the US East Coast.
Start
Find out what stands between you and launch.
Buy the audit and get a prioritized list and a fixed quote in 3 business days. Not ready yet? Ask for a free teardown.
Secure checkout via Stripe · Refund policy
Founding rate $290 · first 5 clientsPrefer to talk first? Book 30 min or email badii@badii.studio
Free teardown
48h · max 5 / week