45% of tests
Generated code with security flaws
In Veracode’s 2025 study of more than one hundred AI models, generated code introduced a security flaw in 45% of the tests. Newer or larger models do no better.
Source: VeracodeTake over an app built with Lovable, Bolt or Cursor
Your tool was generated by an AI, and it breaks, regresses with every fix or never reaches production. I audit it for free, secure it and finish it, at a fixed price, without throwing everything away.
- 7 years of experience
- 17 projects online
- 5/5 on Malt
- Free audit, first opinion within 48 hours
- Code and data stay yours
- Remote, anywhere in France and Europe
Sound familiar?
Six situations I find in almost every AI-generated app
If you recognise two or three of them, it is not a failure. It is the moment a prototype has to become a real application.
Every fix breaks something else
You ask for a tweak, the AI repairs one screen and unsettles another. After ten round trips, nobody knows what still works.
The database is open to everyone
Generated access rules are often far too permissive: anyone who knows the address can read your customer records. That is a legal problem, not only a technical one.
Impossible to add a feature
The payment, the reminders or the export you wanted from the start no longer go through: the AI goes round in circles on logic it no longer understands.
Credits fly away
Every attempted fix consumes credits, even when it fails. The bill goes up and the project stands still.
It works for you, not for twenty users
Slowness, data getting mixed up, double bookings as soon as several people work at the same time.
Nobody wants to take over the code
The provider or the tool is gone, or a developer had a look and advised you to rebuild everything. You are stuck with a tool you use every day.
What the audit looks at first
What your app exposes without you knowing
Four points I check before anything else, with the public figures showing this is not theoretical.
CVE-2025-48757, score 9.3 out of 10
Lovable databases readable by anyone
A vulnerability published in May 2025 describes insufficient access rules on the databases of Lovable-generated sites: reading and writing possible without an account. Lovable answers that protecting the data remains each customer’s responsibility. So it has to be checked on yours.
Source: cve.orgSupabase rule
Without access rules, a table is public
The documentation of Supabase, the database behind Lovable and Bolt, says it plainly: a table exposed without Row Level Security is readable and writable by any role granted on it, including the public role your app uses.
Source: Supabase documentation0.50 to 2 credits per request
Fixes charged even when they fail
At Lovable, every message in build mode costs credits: greying out a button 0.50, adding authentication 1.20. A request stopped halfway is charged for the work already done, and monthly credits expire after two months.
Source: Lovable documentationFree test
Is your AI-built app solid enough?
Eight questions about your tool, its users and its data. The test gives you a risk level, the points I would check first and the right formula. No sign-up.
Question 1 of 8
Which tool built the app?
The one that generated most of the code.
How I work
From the free audit to a reliable app
You can stop after any step, and your app stays online throughout.
- Audit
A free audit, no commitment
Thirty minutes by video call or phone, then I read your code and your access rules (read-only GitHub repository, or an export from the tool). Within 48 hours, you know whether your app can be saved and where to start.
- Diagnosis
A written diagnosis, sorted by urgency
If you want to go further, I write the full list: flaws, bugs, technical debt, what we keep and what we rebuild, with a fixed price for each step. Deducted from what follows if you continue.
- Takeover
Secure, stabilise, finish
Data and access first, then the blocking bugs, then the missing features. I work on a copy and we switch over when it is ready.
- Afterwards
The code in your name, and a backup if you want one
A GitHub repository you own, documentation, backups in place. You carry on with the AI on a sound base, or you hand me the maintenance.
Prices
Prices set before we start
Every step has its price, announced upfront, and you can stop after any of them.
Audit
Free
A thirty-minute call, a read of the code and the access rules, a first written opinion within 48 hours.
Written diagnosis
€400
The full list of flaws, bugs and fixes, sorted by urgency, with a fixed price per step. Deducted if you continue.
Security hardening
€900 to €1,500
Database access rules, keys removed from the browser, backups, accounts and permissions. Three to seven days.
- Most common
Takeover and production release
€2,500 to €6,000
Blocking bugs fixed, duplicates removed, tests on the sensitive flows, clean deployment. Two to four weeks.
A full rebuild is priced after the diagnosis: most small-business tools fall between €5,000 and €15,000.
Maintenance afterwards, if you want it: €100 to €300 per month.
Net prices: VAT not applicable (article 293 B of the French tax code).
What you get back
In the end, everything is yours
The code on a repository in your name
A GitHub repository you own, readable by any developer. You are no longer locked into a tool.
Protected data
Each user only sees their own data, sensitive keys live on the server, and a test proves it.
Tests and a repeatable deployment
The flows that matter (login, payment, booking) are tested automatically, and going live takes one command.
Documentation and someone to call
How to run, back up and restore the app, written down. And someone to call.
Real case
An AI automation tool, built with Base44 then Lovable, rebuilt to last
A client came with a tool he had built himself, and used every day despite the crashes.
Before
- An AI automation tool built by the client himself, with Base44 then Lovable
- Bugs at every use and unstable results
- An architecture that blocked any change, and an interface that wasted time
What I did
- Read the existing tool to keep exactly what it had to do
- Rebuilt the application with mainstream technologies, chosen for the need rather than for the demo
- Redesigned the interface around the client’s daily work
After
- A stable tool, used every day
- Readable code that any developer can take over
- A base ready for the next features, built to last for years
Sample diagnosis
What the report you receive looks like
Extract from a diagnosis written on a demonstration project (a booking app generated with Lovable), to show the level of detail. Each point gives the finding, the severity and the planned fix.
Critical · The customers table can be read without an account
No access rule on the customers table: with the app’s public key, anyone can list names, emails and phone numbers. Fix: per-user rules, verified by an automated test.
High · The payment key ships in the browser code
The Stripe secret key is called from the page. Fix: move the call to the server and rotate the key.
Medium · Two bookings can take the same slot
Nothing stops two customers from booking the same place at the same time. Fix: a database constraint and a clear message to the user.
Watch · No restorable backup
The host backs up the database, but nobody has ever tested a restore. Fix: a daily backup and a documented restore drill.
Frequently asked questions
Taking over an AI-built app: your questions
Can my app be saved?
In most cases, yes. If the structure holds, we secure it, clean it up and carry on from your code. If every screen was patched separately, starting again on a clean base is sometimes cheaper than plugging holes for months. The free audit tells you before you spend a euro.
Does everything need rewriting?
Rarely. Rewriting erases what already works. I keep the interface and the flows your users know, and I only rebuild the foundations that give way: access, data, payment, deployment.
How do I hand over my Lovable or Bolt code?
Lovable and Bolt sync the project with a GitHub repository you own; you give me read-only access to it. Without a repository, an export of the code is enough for the audit. I change nothing without your agreement.
Do I keep my subscription during the takeover?
During the audit, yes, so that nothing moves. Afterwards, it is up to you: many keep the tool to mock up new screens and hand a developer everything that goes to production.
Could my data have leaked?
It is the first thing I check. If the database was open, I tell you in writing, with what the GDPR requires from you (informing the people concerned and notifying the regulator within 72 hours when the risk is real), and I close the door the same day.
How long does it take?
A first opinion within 48 hours. Security hardening in three to seven days. Takeover and production release in two to four weeks. A full rebuild follows the pace of a regular project, delivered in stages.
Do you also work on v0, Cursor, Claude Code, Replit or Base44?
Yes. Tools change, the flaws look alike: access too wide, keys in the browser, no tests, no backup. I took over a tool built with Base44 then Lovable, and I work in React, Nuxt, Vue, Node.js and Python.
Can I keep using the AI afterwards?
Yes, and it is even advisable for small tweaks. The difference is that once in production, every change goes through a review and tests before going live.
Do you work remotely?
Yes, with businesses in Rennes, in Brittany and elsewhere in France. Video calls, phone, repository access: everything happens remotely, with regular check-ins.
Blog
Further reading
What I have written about AI-generated apps, no-code and custom tools.
An AI-built app that worries you?
Send me its address and a few words about what is wrong. I read the code and you leave with a first written opinion within 48 hours, free, even if the conclusion is that everything is fine.
- contact@dibodev.fr
- 06 42 19 38 12
- Saint-Erblon, near Rennes