Production readiness review — UK
Your AI-built app works.Now make it safe to run a business on.
I've been building with AI for three years, since before these tools were any good. Which is how I know which parts still aren't. Five days, fixed price — security, architecture, scale and operations.
Twelve months ago these tools produced prototypes. Now they produce products with real customers and real money moving through them.
The tooling got good faster than anyone's engineering practices did — and that gap is what I assess.
9 out of 10AI-built apps I openhave at least one critical issue
5 daysFrom kickoffto report
£1,850Fixed priceno variation
3 yrsBuilding with AI15 years in software
What I look at
What I actually look at
Security
Who can reach what they shouldn't.
- API keys in the frontend bundle, because the tool set an env var without the server-side prefix
- Row-level security never switched on, so any logged-in user can read every other user's rows
Architecture
Whether you can still change this thing.
- Business logic duplicated across components, so one change needs four edits
- No tests, so nobody can refactor safely and the codebase slowly calcifies
Scale
What happens the week you get busy.
- Queries with no indexes — fine at a hundred rows, fatal at a hundred thousand
- Synchronous work that should be queued, so one slow third-party call takes the app down
Operations
Whether you'd cope on a bad day.
- Deploys nobody can reverse
- Backups that exist but have never actually been restored
An assessment across four dimensions — not a deep audit of each. You get what will hurt you, and in what order.
Security
The security questionnaire arrives mid-deal, and everything stops.
Architecture
Shipping slows to a crawl; every feature costs triple.
Scale
Your best week becomes your worst outage.
Operations
An incident you can't explain to the customer it affected.
What you get
Two documents, in five working days.
A prioritised findings list your engineers can work straight from — severity, where it is, and how to fix it.
And a one-page executive summary, written to be forwarded. To a board, an investor, or a customer's security team. That second document is the one that unblocks enterprise deals.
2:39 — what the review covers, and what you get
Start here
Production Readiness Review
£1,850 fixed · 5 days£1,850 fixed — or nothing. If you read the report and don't think it was worth the fee, tell me and you don't pay. No conditions, no arguing about severity ratings.
- Security — access, secrets, auth, audit logging
- Architecture — structure, duplication, test coverage
- Scale — queries, indexes, caching, queueing
- Operations — deploys, backups, monitoring, access
- UK GDPR exposure snapshot
- Prioritised findings list + one-page executive summary
Rescue & Hardening Sprint
£9–18K- Fix critical security issues
- Refactor risky or fragile code
- Improve architecture & reliability
- Add tests, CI/CD & observability
- Harden infrastructure & configs
- Knowledge transfer included
Most teams move here after the review. About a third take the roadmap and run the fixes in-house — both are fine.
Production Care
£1,900 / month- Proactive monitoring & alerts
- Security patching & updates
- Performance & reliability tuning
- Backups, DR & incident response
- Monthly reviews & reporting
- Priority access to our team
Who reviews it
I run every review personally.
Sergii Gromovyi
15 years building software. Three years building with AI, since before these tools were any good.
Multi-tenant production systems for enterprise clients — construction analytics at CPEC, a two-sided hiring platform at JAAI, a voice AI product from concept to App Store.
No project managers, no handoffs. The person reviewing your codebase is the person writing the report.
LinkedIn →How we work
01
Discover
I start with your app, your stack and your business context.
02
Review
I review security, architecture, scale and operations.
03
Report
You get a clear risk report and prioritised remediation plan.
04
Harden
I fix what matters and get your app ready for production.
FAQ
Will you need access to our codebase?
Read-only access to your repository, deployment configuration and infrastructure is enough. Read-only means I can't change anything, even by accident. I never touch production, we work under NDA, and you get a written access log when the review closes. On GitHub it's about two minutes to add me, and two minutes to remove me at the end.
What exactly is included in the Production Readiness Review?
A full security audit, an architecture and code review, a risk and compliance assessment, and an operational readiness check — covering deploys, backups, monitoring and access control, including a UK GDPR exposure snapshot — and EU AI Act exposure if you sell into the EU. You get a prioritised remediation roadmap and an executive summary you can share with stakeholders or investors.
How long does the review take?
Five working days from kickoff to report, on average. Larger or multi-service codebases can run a little longer — I'll tell you upfront during the readiness check, not after I've started.
What happens after the review?
You get the report and roadmap either way, no strings attached. Most teams move straight into a Rescue & Hardening Sprint to fix what the review found; some prefer to run the fixes in-house using the roadmap as the brief.
Do you work with non-technical founders?
Yes. I work with technical and non-technical founders, and I explain findings in plain English — what matters for your business, not a wall of jargon.
Find out what's in your codebase before someone else does.
Built to protect what you're building