Readiness audit
A fixed-scope review of code, security, data, infrastructure and AI spend, with a load test and a prioritised fix list you keep.
Sheet 01 / Overview
For products built with AI that now need to scale
Prototype
→Production.
You used AI to build the first version, and it worked: users signed up and the idea is proven. Now it needs to survive real traffic, real money and real attackers. We're the engineers who make that happen, without throwing away what you've built.
Keep your stackYou own all code & infraFixed-scope audits
Fig. 1What changes
Same product. Different foundations.
Most AI-built apps share the same architecture: one app that talks straight to everything. Switch to the production view to see what we change, and why.
What we usually find
Six issues we see in almost every AI-built app we audit.
- 1Secret API keys shipped inside the frontend bundle
- 2Authorization done in the UI, so the server trusts anyone
- 3Direct LLM calls with no cache, limits or fallback
- 4Open database rules, missing indexes, untested backups
- 5Payment webhooks anyone can call
- 6No tests, no logs, and deploys from a laptop
What we change
Shipped in small, reversible steps while the product stays live.
- 1Edge cache and WAF absorb spikes and bots
- 2Secrets move server-side, out of the bundle
- 3Every request authenticated, authorised and rate-limited
- 4Indexed data model, replicas and tested restores
- 5Slow work moves to queues and background workers
- 6An LLM gateway with caching, fallbacks and budgets
- 7Every change tested and deployed by CI; infrastructure in Terraform
- 8Logs, traces and alerts, so you know before customers do
Fig. 2Readiness check
How production-ready is your app? Find out in 60 seconds.
Tick what's already true for your product. Be honest: nothing leaves your browser unless you send it to us.
Fig. 3Services
Six disciplines. One team.
Book one, or let us run all six as your engineering team.
Security hardening
Server-side auth and RBAC, secret management, database rules, verified webhooks, App Check, abuse prevention.
Architecture & scale
Clear service layers, a sound data model, indexing, caching, queues, and re-platforming where it pays for itself.
Cloud & DevOps
Terraform-managed infrastructure, CI/CD with tests on every change, staging environments and cost control.
AI engineering
Dependable AI features: evals, prompt versioning, streaming, caching, provider fallbacks and spend limits.
Product team
Web, iOS, Android, backend and admin tools. We keep shipping features on foundations that hold.
Fig. 4Work
In production. With real users.
Telecom, hiring, community, non-profit and local business, plus an open-source tool for working with AI agents.
Kudo eSIMkudoesim.com
Telecom · Mobile · Payments
eSIM data in 190+ countries, activated in about 30 seconds. The first eSIM in the Balkans.
- Flutter app on a Go API, Cloud Run and Firestore
- Stripe and Western Union payments, webhook fulfilment
- Abuse controls rolled out in shadow mode, by app version
Flutter · Go · Firestore · Stripe · Terraform
Visit↗
magnetilomagnetilo.com
HR tech · Marketplace · CH
Swiss hiring through referrals, with bonuses paid to candidates, referrers and headhunters.
- Re-platformed from Node on AWS Lambda to Go on Cloud Run
- Bonus engine, invoicing, payslips and VAT
- Companies verified against the Swiss register (Zefix)
Go · React · Firestore · Cloud Run · Terraform
Visit↗
Deen Volunteersdeensvolunteer.com
Community · Platform
Matches volunteers with community projects. 500+ volunteers, 10k+ hours logged.
- Rule-based matching on skills and availability
- Go API with sqlc on PostgreSQL 16
- Cloud Run, Secret Manager and Cloudflare in Terraform
Next.js · Go · PostgreSQL · Supabase Auth
Visit↗
Kosovar Youth Councilkyc-ks.org
Non-profit · CMS · EN/SQ
A new bilingual home for KYC, the youth NGO working in Kosovo since 1999.
- WordPress content moved to Payload CMS, safely re-runnable
- Schema migrations run on every deploy
- Runs on free tiers: Vercel, Neon, Cloudflare R2
Next.js · Payload CMS · PostgreSQL · R2
Visit↗
AutoMotiveauto-motive.app
Local business · Web
A German-car specialist garage in Gjakovë: Audi, VW, Mercedes-Benz and BMW.
- No dependencies, no build step, one fast page
- Local-search structured data and Google Business Profile
- Booking via phone, WhatsApp and Viber
HTML · CSS · JSON-LD · Vercel
Visit↗
OPEN SOURCE · MIT
hive
github.com/SadriShehu/hive
Developer tools · AI agents
Every Claude Code, Codex, opencode and Copilot CLI session as one live tree in tmux.
- See who spawned whom, and which agent is waiting on you
- One Go binary with SQLite. No daemon, never wraps the agents
install --dry-rundiffs every file first
Go · Bubble Tea · SQLite · Homebrew
View on GitHub↗
Fig. 5Approach
Four principles. Three ways to start.
Handing over a product you built is a big step. This is what you can hold us to.
P1
We don't rewrite what works.
Your prototype has already found real users, and that's worth a lot. We refactor in place and only re-platform when the numbers say so, and we'll show you those numbers.
P2
Boring technology, on purpose.
Go, Postgres, Terraform, managed cloud. Proven tools that the next engineer, and the next AI model, already understand.
P3
You own everything.
Repositories, cloud accounts, domains and credentials stay in your name from day one. No lock-in, no hostage situations.
P4
If it isn't written down, it isn't done.
Architecture notes, runbooks, a README that works, and an AGENTS.md so the AI tools your team uses build safely too.
1–2 weeks · fixed scope
Audit
Find out exactly where you stand before you launch, raise money or run a campaign.
- Code, security and data-model review
- Load test of critical paths
- AI usage and cloud cost review
- A prioritised fix list you keep
4–8 weeks · fixed scope
Scale-up sprint
We fix the critical findings and put the foundations in place.
- Security hardening
- Tests around money and auth flows
- CI/CD, staging, Terraform
- Monitoring, alerts and backups
Monthly · flexible
Embedded team
We become your engineering team, or work alongside the one you have.
- Web, mobile and backend features
- On-call and incident response
- Architecture decisions, documented
- AGENTS.md so your AI tools build safely
Fig. 6Questions
Things founders usually ask us.
Q1Do you only work on AI-built products?
No. Most of what we do applies to any product that has outgrown its first version. AI-built products just reach that point faster, and they tend to share the same blind spots, which makes them quicker for us to fix.
Q2Will you rewrite my app?
Almost never as a first step. We start by making what you have safe and observable. If parts need to be re-platformed, as with Magnetilo's move from AWS Lambda to Go on Cloud Run, we do it piece by piece, with the old system running until the new one has proven itself.
Q3Can my team keep using AI tools afterwards?
Yes, and they should. We leave tests, CI checks and an AGENTS.md / CLAUDE.md that tell AI agents how your codebase works, so the tools speed your team up instead of slowly undoing the hardening.
Q4What do you need from us to start an audit?
Read access to the repository, a staging environment (or we'll set one up), and an hour with whoever knows the product best. That's it.
Q5Do you build mobile apps too?
Yes. Kudo eSIM's iOS and Android apps are built in Flutter, and we cover backend, web and admin tools as well.
Ready for real users?
Send us the link to your product or repository. Within two working days we'll reply with what we'd look at first and a fixed-scope audit proposal.
email · hello@nanobitech.com