01 · fix-and-break loops
You fix one thing and another breaks
Every prompt burns credits and the app gets no closer to done. We pin down the one bug that keeps coming back and fix it as a single, scoped job. If the loop really needs a rewrite, we'll say so and point you elsewhere rather than quote one.
02 · auth after publish
Login works in preview, fails on the live site
Site URL still set to localhost, OAuth callbacks that don't match your domain, confirmation emails that never arrive. We fix the redirect and provider settings on your real URL.
Checklist §1
03 · works locally, breaks in prod
It runs on your laptop and nowhere else
Missing production env vars, hardcoded localhost, CORS errors, silent server failures. We find what differs between your machine and the deployed app and fix it.
Checklist §2
04 · stripe webhooks
Paid, but nothing unlocked
Webhooks that never arrive, signatures that fail on the raw body, test and live secrets mixed up, access granted from a success page anyone can visit. We wire up a verified webhook and test it in Stripe test mode.
Checklist §3
05 · supabase rls
Row Level Security missing or too loose
Tables with RLS off, policies that let everyone read everything, grants that don't match what you intended. We review and fix the common failure points and give you a written report.
Checklist §4
06 · leaked keys
Secrets in the browser, endpoints with no limits
Secret keys shipped in client code or git history, AI endpoints with no auth, rate limit, or spend cap. We check for them, fix what's in scope, and tell you what to rotate.
Checklist §5