Skip to content

Merge · you have code

Your vibe-coded app, merged into production.

You built something people want. We make sure it doesn't leak their data, fall over at launch, or quietly run up your bills. Fixed quote, in your repo, in days.

Get a free Preflight checkSee packages

The nebula

What we find in almost every vibe-coded app.

AI tools optimise for a working demo. Production needs things a demo never tests: hostile users, real money, and traffic you didn't plan for.

preflight / example-app.lovable.app

Example report

46/100

Not ready for launch

  • Secrets in client bundle2 keys exposed
  • Row-level security3 tables open
  • Payment webhooks verifiedNo signature check
  • Rate limiting on AI routesMissing
  • Security headersOK
  • HTTPS and redirectsOK
Illustrative example based on issues we commonly see. Your report covers security, performance, cost, and code quality.

  • Keys in the browserCritical

    Service keys and API secrets shipped inside the JavaScript bundle.

  • Row-level security offCritical

    Any signed-in user can read or edit every other user's data.

  • Payments out of syncHigh

    Webhooks unverified or unhandled, so subscriptions drift from reality.

  • Runaway billsHigh

    No rate limits on AI and API calls. One bot can burn a month's budget.

  • No safety netMedium

    No tests, no CI, no staging. Every change is deployed straight to users.

  • Flying blindMedium

    No error tracking, logs, or backups. Outages are reported by customers.

The process

Scan. Merge. Launch. Orbit.

Every step has a fixed scope, a fixed quote, and something concrete you keep, even if you stop there.

  1. Step 01

    Scan

    We audit your code, infrastructure, security, and running costs.

    You get
    Scored readiness report and fix roadmap
    Time
    3–5 days

  2. Step 02

    Merge

    We fix what's critical, refactor the hotspots, and add tests and CI.

    You get
    Reviewed pull requests in your repo
    Time
    1–2 weeks

  3. Step 03

    Launch

    Production hosting, domains, monitoring, backups, and a rollback plan.

    You get
    Live app and a runbook
    Time
    1–3 days

  4. Step 04

    Orbit

    Ongoing monitoring, patches, and small changes as you grow.

    You get
    Monthly health report
    Time
    Monthly

Packages

Pick where you are.

Start with a Scan and its fee is credited toward Launch. Already live? Go straight to Harden.

Scan

3–5 days

Find out if your app is safe to launch.

One-off fixed fee

Quoted after a free call

  • Security, performance, cost, and code review
  • Scored readiness report
  • Prioritised fix roadmap
  • Fee credited toward Launch
Book a Scan

Launch

~2 weeks

Take your vibe-coded app to production.

Fixed quote

Quoted after a free call

  • Everything in Scan
  • Critical fixes and auth and payments hardening
  • Tests on core flows, CI/CD pipeline
  • Production hosting, monitoring, backups
  • Runbook and handover call
Start a Launch

Harden

~1 week

Already live and worried about security.

Fixed quote

Quoted after a free call

  • Authorization and row-level security review
  • Secrets, rate limiting, input validation
  • Dependency and configuration audit
  • Fixes delivered as pull requests
Book a Harden sprint

After launch: Orbit care plans

Monitoring, patches, and small changes every month, on a plan sized to your app.

See Orbit plans

Cosmerg Security Standard

Ten checks every app passes before launch.

This is the minimum. Your Scan report tells you which ones your app fails today.

Read the full standard
  1. 01Secrets kept server-side and rotated after handover
  2. 02Authorization and row-level security on every table
  3. 03Auth hardened: sessions, password reset, OAuth callbacks
  4. 04Input validated on the server, never only in the browser
  5. 05Rate limits on auth, AI, and paid API routes
  6. 06Payment webhooks verified and idempotent
  7. 07Dependencies scanned, known vulnerabilities patched
  8. 08Security headers and HTTPS everywhere
  9. 09Backups enabled and a restore tested
  10. 10Errors and logs captured without leaking user data

FAQ

Before you send us your repo.

What do you need from me to start?

Read access to your repository and a short call about how the app is used. For the Launch package we'll also need access to your hosting and database, which we scope to the minimum.

My app was built in Lovable or Bolt. Can I keep using it?

Yes. We keep your app compatible with the tool where possible and tell you clearly when a fix means moving off it.

What if the Scan finds nothing serious?

Then you have written proof your app is ready, which is useful for investors and customers. If the report has nothing actionable, we refund the fee.

How do you handle my credentials?

Least-privilege access only, never shared over chat, and we help you rotate every key when the work is done.

Find out what's between you and launch.

Send us your app URL. We'll tell you what to fix first, free.

Get a free Preflight checkBook a Scan