AI-built apps
Your AI-built app works. Is it ready for real customers?
Cursor, Lovable and Bolt get you an app fast. But AI-written code often misses what only shows up with real users: keys sitting in the browser, one user reading another's data, an API bill that jumps overnight. I read the code, point out the risks and fix exactly those. What already works stays as it is.
Send me the app- You work directly with the engineer, no middleman.
- Scope, price and timeline agreed in writing before any work.
- NDA available if you need one.
Worth checking if
- Your app was built with Cursor, Lovable, Bolt, v0 or Replit and is about to open to customers.
- You use Supabase or Firebase but aren't sure the access rules are on and correct.
- The app has sign-in, payments or stores customer data.
- It calls OpenAI, Claude or Gemini with no limit on how often.
- Fixing one bug by prompting brings back another, and nobody has read all the code.
What I check
- Data: Supabase or Firebase access rules, keys shipped in browser code, users who can read other users' data.
- Sign-in, permissions, payments: the server-side checks AI-written code tends to leave out.
- AI model costs: unlimited calls, no caching, easy for strangers to run up your bill.
- Going to production: environment variables, database backups, error logging, domain and SSL.
- A list of fixes in three priority groups, with time and cost estimates.
Good to know
- I don't rewrite the app. What works stays; only the risky parts get fixed.
- Not included: formal penetration testing or security certification.
How it works
4 steps, clear from the start
- 01
Send the app
Share the app link and read access to the repo (GitHub, GitLab). I confirm the scope and send a written quote.
- 02
Read and test
I read the code, sign in with a few test accounts and call the API directly like an outsider would. Nothing changes on the live app without your OK.
- 03
Get the report
Security holes and risks in three priority groups, with how to fix each and what it costs.
- 04
Fix, if you want
Your call: fix it yourself from the report, have me fix it, or hire someone else.
About me
You work with me directly
For more than 15 years I've built and run systems at major technology platforms in Vietnam. At GocFix, the person you talk to is the one reading the code, configuring the servers and answering for the result.
Triet Tran
What I work with day to day
- AI and automation
- AI agentsAI model integrationLocal AI modelsRAGInvoice and document OCRAPI integrations
- Languages and frameworks
- JavaPHP / WordPressSuiteCRMPython / FastAPINode.js / TypeScriptGoReact / Next.js
- Databases
- MySQLPostgreSQLSQLiteMongoDBRedisElasticsearchQdrant (vector)
- Queues
- KafkaRabbitMQCelery (Python workers)
- Servers and operations
- LinuxDockerKubernetesNginx / CloudflareCI/CDBackup, monitoring
- Data security
- Access controlData encryptionHashiCorp Vault
FAQ
Common questions
I don't code. Is this still for me?
Yes. The report starts each issue with what it means for your business; the technical detail comes after. I also walk you through it when I send it.
Will the app need a rewrite?
Usually not. Most problems sit in a few places: database access rules, permission checks on the server, where the keys live. Fixing those is far faster and cheaper than starting over.
Which stacks can you review?
Most often Next.js, React, Node.js or Python, with Supabase, Firebase or PostgreSQL. If yours uses something I don't know well, I'll say so up front.
Do I need to send passwords or keys?
Not through the form or chat. I'll show you how to give read access to the repo and set up a separate test account for the review.
Do we sign a contract?
Yes. Before any work starts, the scope, cost, timeline and how the work is signed off are put in writing. I'm happy to sign an NDA as well if you need one.
How do you keep code and data safe?
I only ask for the access the job needs and give it back at handover. How data is handled and an NDA are agreed before we start. Please don't send passwords or API keys through the form on this page.
Contact
Send me the app
The app link (if any), what you built it with, which database, and roughly how many users it will open to. Don't send passwords or keys.
- I only take on a few projects a month so each one gets proper attention.