AI Code Cleanup
Payments, access, and a place the app runs.
For a generated app that does the demo and is not yet a system you can charge for. We score payments, server-side access, and where it runs, then repair the paths customers actually hit.
Three gaps. One audit.
Most of what the model produced should be deleted. These three cannot wait, because they are how the app takes money, who it lets in, and whether it is up tomorrow.
Payments
The app has users and no charge that survives a dropped webhook. Checkout, renewal, cancellation, and the record of the payment are part of the path the audit scores. A card form on the page with the secret in the bundle is a delete, not a repair.
Access
Secrets come off the client. Every route checks permission on the server. Uploads, rate limits, and dependencies are in the same pass. A check that lives only on the button does not count.
Where it runs
A domain, mail that reaches the inbox, logs, and a named owner for the hour it falls. The host is one the client controls, or an EU operator. The leave-behind is that owner, not a subscription on our machines.
Same checklist on the way in and on the way out.
Three steps. You are in them. The founder is in them. The engagement is designed to end.
Audit.
$10,000. A scored keep / repair / delete report in 7 days. Payments, access, and where it runs are the load-bearing paths. The rest of the generated tree is scored for deletion.
Repair.
A separate quote, usually 6–8 weeks. Fixed milestone. We repair the paths customers hit and delete what nobody owns. We do not hand you a person to pay by the hour.
Acceptance.
The repair is accepted against the same checklist as the audit. What fails the checklist is not the deliverable. You leave with the repaired path, the report, and one internal owner. If there is no one to name, the stay-behind is a Harness Engineer on a later milestone.
What this engagement refuses
A public scan of a URL is not the audit. Send the repo, or a link we can be given access to, on the scoping call. We do not fetch arbitrary addresses from this page.
We do not introduce a contractor for you to pay directly, and we do not run a pool of them.
We do not host the app. If the constraint is that prompts, documents, outputs, and logs must stay in the EU, the next page is Sovereign AI. If the boundary is the UAE, the next page is the UAE deployment.
Common questions
No. It is the same audit and the same repair, entered from the moment the generated app has to take money, keep strangers out, and stay up. The price is $10,000 for the report in 7 days. The repair is quoted after the report.
Those tools explain how the tree got ahead of review. They do not change the deliverable. The report still says what to keep, what to repair, and what to delete. The names of the tools stay out of the statement of work; the repo is what we score.
No. The people who score the repo repair it, on a fixed milestone, and the engagement ends. A person you pay by the hour, chosen from a pool, is a different business.
No. The repair can put it on a host you control, or on an EU operator, and name who is called when it falls. A monthly plan on our machines is not for sale. A data boundary that must stay in the EU is Sovereign AI. A boundary that must stay in the UAE is the UAE deployment.
Say that on the scoping call. The repair still needs a named owner. When the company cannot name one, the next milestone is a Harness Engineer, scoped separately. We do not stay on as an open-ended watcher.
Access to the repo, and to the path a customer actually hits: the payment call, the routes, and where it is deployed today. No access means no engagement. A 30-minute call is enough to tell whether the audit is the right first step.
Bring the repo.
A 30-minute scoping call is enough to tell whether this audit is the right first step.