Launch Check for AI-Built MVPs
Built it with Lovable, Bolt, Cursor, Base44, Replit or v0? Before real users or investors arrive, I spend 5 working days checking what the tool didn't: exposed keys, Supabase RLS, auth, payments, tests and load. You get a written report and a straight keep, fix or rebuild verdict.
Fixed fee
AED 9,500
$2,500 · £2,000
- 5 working days, fixed fee
- Security, Supabase RLS, auth, payments, tests and load
- Written report and a keep / fix / rebuild verdict
- Fee credited in full to a retainer signed within 30 days
Free 30-minute fit call first. No obligation.
For apps built with
- Lovable
- Bolt
- Cursor
- Base44
- Replit
- v0
Agency-built code on React, Next.js, Supabase and Node works too. More on AI-built apps.
What usually breaks
The Gaps AI Builders Leave Behind
These are the patterns that come up again and again in AI-generated code. None of them shows up in a demo: the app works the same with or without them, which is exactly why they ship.
Exposed keys
Secret keys for Stripe, an LLM provider or the Supabase service role end up in the browser bundle or in git history, where anyone can copy them.
Missing or wrong Supabase RLS
A table created mid-prompt with no row-level security, a USING (true) policy, reads locked but updates and deletes open, or a policy that trusts a user_id sent by the browser instead of auth.uid().
Auth that only works for user #1
Everything looks fine for the founder's account. The second user can see, change or break someone else's data, and role checks exist only in the UI.
Payment webhooks taken on trust
No signature verification and no idempotency, so a retried webhook creates a duplicate order, or a failed one silently drops a payment.
Never tested under load
The app is fine with ten users and slows to a crawl at a hundred, because a missing index or an N+1 query was never measured.
No tests, no staging
Every fix breaks two other things, because nothing checks the sign-up, payment and core flows before changes go live.
Read more first
What's checked
Six Areas, Checked by Hand
I read the code the tool generated and test the app the way an attacker or an unlucky second user would, rather than asking another AI whether it looks fine.
01
Security & secrets
- Keys in the client bundle, env files and git history
- Service-role and admin keys kept server-side
02
Data & Supabase RLS
- RLS enabled on every table
- Policies for select, insert, update and delete
- Identity from auth.uid(), not the request body
- Storage buckets and file URLs
03
Authentication & access
- Sign-up, login, reset and session expiry
- Everything retested as a second user
- Roles enforced on the server, not just the UI
- Admin routes and internal tools
04
Payments & webhooks
- Webhook signature verification
- Idempotency on retries
- Refunds, failed payments and cancellations
05
Tests
- What is tested today, and what isn't
- Untested money paths: sign-up, checkout, core flow
- A minimal test plan for the critical flows
06
Load & performance
- A basic load test on key flows, agreed with you
- Slow queries, N+1s and missing indexes
- Page weight and load time on mobile
What you get
A Decision, Not Just a List
Written report
Every finding in plain English, with evidence and a severity rating, so you know exactly what is at risk, why, and what to fix first.
Keep / fix / rebuild verdict
A straight answer on whether the current build can carry real users, with the reasoning behind it.
How it works
Five Working Days
It starts with a free 30-minute fit call, where we agree the scope, the start date and the access I need. Read-only access covers almost everything.
Map it
Kick-off, access checks, walk the app as a new user, map the architecture, accounts and data flows.
Security & data
Secrets in the bundle and git history, RLS on every table and bucket, auth retested as a second user.
Payments & webhooks
Webhook signatures, idempotency, refunds, failed payments and cancellations.
Tests & load
Existing tests and critical gaps, and a basic load test on the key flows, agreed with you.
Verdict & report
The written report and the keep / fix / rebuild verdict, delivered to you.
If I find something urgent, such as a live secret key in the browser, you hear about it the same day, not on day 5.
What happens next
Three Ways Forward
The report is yours either way. There is no obligation to hire me for the fixes.
Fix it yourself
No further cost
Many findings are configuration-level and quick for your own developer. The report marks which ones those are and what done looks like.
Rescue to Production
From AED 55,000 / from $15,000
I fix it with you. Fixed scope, billed by milestone, with a clear “production-ready in N weeks” target.
More on AI-built apps→Fractional CTO
AED 45,000 / $14,000 per month
I stay on 2 days a week as your part-time CTO through launch, hiring and the next raise, until you are ready for a full-time CTO.
How the fractional CTO role works→The Launch Check fee is credited in full against a retainer (Advisory, Fractional CTO or Embedded CTO) signed within 30 days.
Retainers are billed monthly in advance, with a 3-month minimum and then one month's notice. Raising soon, or need a view on the team and process too? See the Production & Investor Readiness Review.
Who does the check
Checked by a CTO Who Reads the Code
I'm Mohit Sengar, a Dubai-based CTO with 7 years in the seat. I take AI-built and agency-built products to production and make them investor-ready, and then I stay on as your part-time CTO until you're ready to hire a full-time one. You work with me directly.
I've spent 14+ years building software for 40+ companies, starting with security software at Glasswall. The tests and load work in the Launch Check draw on my delivery bench for QA and quality engineering. I work in person in Dubai and Abu Dhabi, and remotely with founders in the US, UK and Europe.
Credentials
Outstanding Leadership Award, Internet 2.0 Conference, Dubai, February 2024
See the full resume →“Working with Mohit has been great! He is a technical expert in all things development! I can consistently rely on him to provide great advice, technical expertise and well developed solutions. Highly recommended!”
Nathan Jaskot
Client
Who the Launch Check Is Not For
- You haven't built anything yet. A fit call, or Advisory, will help you more than a check.
- You want the problems fixed rather than found. That is Rescue to Production, a fixed-scope project billed by milestone.
- You are raising or scaling and need a view on the team, process and roadmap as well as the code. The Readiness Review is the better fit.
- You need a certified penetration test or a compliance audit such as SOC 2 or ISO 27001. The Launch Check is an engineering review, not a certificate.
- Your product is a large platform with several services and an engineering team behind it. That needs the 2-week Readiness Review.
If it isn't the right step, you'll hear that on the fit call.
Questions & Answers
Launch Check FAQ
Find the Gaps
Before Your Users Do.
Book a free 30-minute fit call. Tell me what you built and when it goes live. If the Launch Check is the right step, we agree a start date; if it isn't, I'll say what is.
Free fit call · 5 working days · AED 9,500 / $2,500 / £2,000 fixed
Prefer email? mohit@sengarconsultancy.org