I read AI-built codebases and tell you what is actually dangerous, what is merely untidy, and what to build next. Fixed-price audit, or two to four hours a week ongoing. No equity. No six-month contract.
Read access to your repo is all I need to start. Not ready? Book a 30-minute call and ask me anything first.
export async function POST(req) { const { userId, amount } = await req.json() await db.execute( `UPDATE wallet SET bal = ${'${'}amount{'}'} ...` )Critical · 1 of 4Route has no auth check. Any visitor can set any user's balance. Critical · 2 of 4Value interpolated straight into SQL. Injectable.
AI coding tools are very good at producing something that runs and very bad at producing something that holds. These are the failures I find most often, in the order they tend to cost money.
API routes that read a user ID from the request body and trust it. Your data is one curl away from anyone who opens the network tab.
Service keys in NEXT_PUBLIC_ variables, or a database URL bundled into client JavaScript. Free for anyone to read.
No indexes, no pagination, and a query inside a loop. Fine at fifty rows. Unusable at fifty thousand, which arrives without warning.
Each one installed to fix a single error, each one now yours to patch. Slow builds, slow pages, and a security surface nobody is watching.
Start with a teardown. If you want someone permanently on the other end of it, the fee comes off your first month. Choose how much synchronous time you need.
£350 + VAT · one-off · 3 working days
£450 + VAT/month · written-first
£700 + VAT/month · 2–4 hrs a week
How the hours work. Four hours a week is the ceiling, not a target. I log what I use and you see the total every month. If a week needs more, I tell you what it will cost before I start it — never after.
What this isn't. An on-call rota. I work Monday to Friday, and calls happen Tuesdays and Thursdays. If your product needs someone reachable at 2am, that's a hire, and I'll help you write the job spec instead.
Your code stays yours. I don't reuse it, publish it, or show it to anyone. Access ends when the work does. If you want that in writing first, send me your NDA and I'll sign it — or I'll send you mine.
You are buying something you can't inspect in advance, from someone you haven't worked with. Here is exactly what happens, so nothing about it is a surprise.
I'm Tomek. I've spent fifteen years building and running production software, most recently a suite of SaaS products of my own — which means I've made the expensive mistakes already, on my own money.
I like AI coding tools. I use them daily. They collapse the distance between an idea and something people can click, and that's genuinely new. What they don't do is hold the shape of a system in mind, and that's the job you're hiring for.
A one-off Teardown is £350 + VAT. That covers a full audit of the codebase and infrastructure, a written findings report graded by severity, and a 45-minute call. Ongoing review comes in two forms: Written Review at £450 + VAT a month (written-first, one 45-minute call per month), or Standing Review at £700 + VAT a month (two to four hours a week, calls when needed).
No. This is paid work with no equity component and no long-term contract. Retainers run month to month and can be stopped at any point.
Almost never. Most AI-built codebases have a small number of genuinely dangerous problems surrounded by code that is merely untidy. The report separates the two, so you know what to fix now and what to leave alone.
No. I work Monday to Friday and answer within one working day. A retainer buys you judgement before things break, not a pager after they do — if your product genuinely needs 24-hour cover, that's a hire, and I'd rather help you write the job spec than pretend one person can be it.
I tell you before I start, with a price, and you decide. The hours are logged and the total goes to you every month, so there's no argument at the end of it. What doesn't happen is quiet scope creep where the retainer slowly becomes a full-time job at part-time money.
On a retainer, yes — for the critical fixes, where speed matters more than teaching. The intent is that you or your team do most of the building while I make sure the decisions underneath it are sound.
Read access to the repository, read access to the hosting and database dashboards, and a short description of what the product is meant to do. Nothing else.
That hasn't happened yet, and I'd be suspicious of anyone who promised it couldn't. But the honest answer is that a report saying "this is in better shape than you think, here are four small things, ship it" is worth the fee — you're buying the answer, not a list of problems. The one thing you won't get is padding: I'm not going to inflate a medium into a critical to make an invoice look justified. The severity grades mean what they say, which is the only reason they're useful.
Yes — there's a full sample report on the site. It's an illustration rather than a real client's product, assembled from the failures I find most often, but the structure, the grading and the level of detail are exactly what you'd receive.
Yes. I don't reuse your code, publish it, or show it to anyone, and I don't train anything on it. Access ends when the work does. If you want that agreed in writing before you hand anything over, send me your NDA and I'll sign it — or I'll send you mine. Any teardown I publish publicly is either my own code or something the owner has agreed to, always anonymised.
The author can't defend the work. Only what's on the page can.
It's a theatre term. An actor is handed a script they've never seen and performs it on the spot — no rehearsal, no writer sitting beside them saying what they meant by that line. Whatever is actually written is all there is.
That's the correct way to read a codebase, and it's the only honest one. When you walk me through your own product, you fill in the gaps without noticing: you know which route is safe because you remember writing the check, and you know that odd function is fine because you remember why. Your reader knows none of it.
Neither does anyone else. Your users, the internet, and anyone probing your app for a way in all encounter it cold. They get the page as written, not the intention behind it. I read it the way they will, and write down what I find.
cold read /kəʊld riːd/ — n. a first performance of unfamiliar material, without rehearsal or preparation; by extension, an assessment made without the benefit of the author's explanation.
Three working days, £350 + VAT, and a report that tells you plainly whether your product is safe to sell.
Book a teardown