Service
Your app was built with Lovable, Bolt, v0 or Cursor. It worked in the demo. Now it breaks with real users, real data, or a real deploy — and nobody on the team wrote the code.
AI app builders are very good at the first 80%. You describe a product and get a working interface, a database, and a login screen in an afternoon. What they generate is ordinary code — React, usually on Vite or Next.js, usually backed by Supabase — which is exactly the stack I build in every day.
The last 20% is where it falls apart, and the failures are predictable. The tool optimises for "it works when I click through it", not for what happens with a second user, a slow network, a bad input, or a production build. By the time those problems show up, the codebase has been regenerated so many times that nobody can say why any given file looks the way it does.
I treat it like any other inherited codebase, because that is what it is. I get the code into a Git repository you own, run it locally, and read it before touching anything. Then you get a written list of what is broken, what is a security risk, and what is fine as it is.
The fixes themselves are ordinary engineering: real row-level security policies, secrets moved server-side, error and loading states on every data call, a typed data layer so a regenerated component cannot silently change what the database receives, and a build that deploys cleanly to Vercel or wherever you host.
You do not have to choose on day one. If the product is still changing weekly, it can make sense to keep generating UI with the tool while I lock down the parts it should not touch: the database policies, auth, payments, and the data layer. Most of these tools can sync or export to a GitHub repository, and that repository is where I work.
Once the product settles, the generated code usually needs a consolidation pass — duplicated components merged, dead code removed, one consistent way of fetching data. I will tell you honestly when you have reached that point, and when a section is better rewritten than patched.
Most of my contract history is taking over code someone else wrote and making it reliable. An AI-generated codebase is the same job with one difference: there is no previous developer to ask, so the reading has to be more careful.
I also build on the same stack these tools generate. CodexGenAI and HireOS are both Next.js and Supabase products I designed, built and shipped solo, with row-level security as the tenancy boundary. And the bugs are familiar: on one React dashboard contract I found and patched a cross-site scripting hole the client had not asked me to look for.
It starts with a written audit, from $300. I read the repository, run it, and send you a plain-English assessment: what is broken, what is risky, what it would cost to fix, and what I would leave alone. The document is yours whether or not you hire me for the fixes.
If we continue, the fixes are quoted as a fixed scope with a price, and you get a working preview link as I go rather than a status report.
Australia · ★★★★★ 5.0
“Jawad is an efficient, detail oriented React expert. He is proactive when it comes to security protections that we hadn't even considered. His fixes were clean, well tested and he was very responsive throughout the project. Great work, highly recommended.”
Yes. Under the hood these tools generate React (on Vite or Next.js), usually with Supabase for the database and auth — the stack I work in daily. I need the code in a Git repository and access to the Supabase project; most of these tools can sync or export to GitHub.
No. Many founders keep generating UI while I secure the parts the tool should not change — database policies, auth, payments, and the data layer. I will tell you if and when the generated code needs a consolidation pass.
Check that row-level security is enabled on every table and that each policy is scoped to the signed-in user, and make sure the service-role key never appears in your frontend code. If any of that is unclear, the audit covers it first.
The written audit starts at $300. Fixes are quoted afterwards as a fixed scope, based on what the audit actually finds rather than a guess.
Usually not. Most generated code is fine; the problems sit in a small number of places — security, data handling, and error states. A rewrite only makes sense for a section that is genuinely beyond repair, and I will show you why before proposing one.
Psychology-backed tools for dating anxiety. I took over the live codebase, closed a security hole, rebuilt payments on Stripe, cleaned up the AI-generated code, and documented all of it.
Read the case study →An AI content studio for creators and teams: generate multi-slide carousels, schedule posts across platforms, and track engagement with sentiment analysis.
Read the case study →An AI resume-optimization platform — tailors resumes to target roles, renders clean PDFs, and ships with a Chrome extension.
Read the case study →A 15-minute call is usually enough to scope it. If I am not the right fit, I will tell you on the call.