Meridian service
Vibe Code Rescue
Most of these apps are partly fine. The UI works. Someone has used the flow. What is dangerous is usually a short list: a key in the client bundle, auth that only exists in React, RLS off, a Stripe webhook that does not check signatures, a deploy that only succeeds in preview. We write that down in about 48 hours, then quote a fixed scope. You keep the repo.
Rescue is not a rewrite
We do not throw away a working UI because a rewrite would feel cleaner. We stabilise what is dangerous, then say keep, harden, or rebuild from what we actually found. The scope after that is something you can budget.
Read the full decision guide: Rescue vs rewrite.
Tools we rescue from
Process
- Intake. A brief and repo access, or an export. Do not paste secrets in the form. We will do an NDA if you need one.
- Diagnostic, about 48 hours. Findings ranked by severity: secrets, auth, tenancy, payments, deploy, structural debt. Then a keep, harden, or rebuild call.
- A quote with edges. Security and money paths first. You approve before we change code.
- Harden, then hand it back. Patches in your repo, deploy notes, and tests or CI if they were in scope. Optional guardrails so the next agent session does not undo the work.
What we fix first
- Exposed secrets and unsafe client bundles
- Broken or client-only auth
- RLS / multi-tenant data leaks
- Stripe stubs, unsigned webhooks, broken subscriptions
- Preview works, production will not
- AI fix-loop / regression spiral
What you get back
- Written diagnostic with severity ranking
- Keep / harden / rebuild recommendation
- Fixed-scope statement of work when you proceed
- Code changes in a repo you own
- Rotation / env checklist for secrets
- Deploy and runbook notes for the scoped work
- Optional: CI gates, agent rules, post-rescue guardrails
Other work in the studio
Two packages sit beside rescue, and neither one is engineering. Customer growth is campaigns, pages, and follow-up. Virtual bookkeeping is a monthly close plus some admin (Standard from $449/month, Starter from $299/month). Neither is a standing weekly meeting. Bookkeeping starts at the fit check, not this diagnostic.
FAQ
What is vibe code rescue?
A defined engagement for apps built mostly with AI coding tools. We look first, then harden security, auth, data, and payments on a fixed scope. A full rewrite is the exception.
How is rescue different from a rewrite?
Rescue keeps the screens and the code that still make sense. We rank what is dangerous, fix that, and only recommend a rebuild when the structure would make patching slower than starting over.
Which AI tools do you support?
Cursor, Lovable, Bolt, v0, Replit Agent, Claude Code, Windsurf, and stacks that look like them.
How fast is the diagnostic?
A written diagnostic within 48 hours of access and a short brief, in most cases. A large monorepo can take longer. We say so before we start.
What do you deliver?
A severity-ranked audit, a keep / harden / rebuild call, and a fixed quote if salvage is the right move. If you go ahead: patched code, notes on rotating secrets, tests or CI where we scoped them, deploy notes, and optional rules so the agent does not undo the fixes.
Do you keep our AI workflow after rescue?
If you want it. We can leave agent scope files, Cursor or Claude rules, CI checks, and a short checklist. Plenty of teams keep shipping with the tools. They just stop shipping the same holes.
Will you shame us for vibe coding?
No. Getting a prototype out fast was a reasonable bet. Production is a different job, and that is the one we do.
Who owns the code?
You do. We work in your repo, or a fork you control.
If the app is stuck, start with a diagnostic.
Tell us what you built and what is in the way. Written scorecard within about 48 hours of access.