Is your v0 app ready for real users?
Two builders review your Next.js routes, server actions, environment and data layer in 48 hours, then give you a fixed price to fix what we find.
US$1,950 fixed (about A$3,000)· 48 hours · Fee credited against any fix
Sound familiar?
- API routes answer anyone who calls them.
- Server actions return more data than the page shows.
- A secret key ended up in a client component.
- The front end looks finished and the back end isn’t there yet.
- Every change the AI makes breaks another page.
- A developer looked at it and said “start again”.
Why this happens
v0 is very good at the part you can see. It generates Next.js interfaces quickly, and the routes and server actions behind them are generated to make the interface work, not to keep strangers out. The result often looks shipped before the back end is.
None of that is your fault, and none of it is unusual. When security firm Escape scanned more than 5,600 publicly deployed vibe-coded apps, it found more than 2,000 vulnerabilities, over 400 exposed secrets and 175 instances of exposed personal data, including medical records and bank details. Source: Escape, research methodology
What goes wrong in v0 apps
API routes that answer anyone
What it looks like. A route that reads or changes data responds to any request, whether or not the caller is signed in.
Why it happens. The interface hides the button from logged-out users. The route handler behind it never checks who is calling.
The fix. Check the session in every route handler and server action, and add middleware so a missed check fails closed.
Server actions that return too much
What it looks like. An action that shows a name and an email returns the whole user record, including fields the page never displays.
Why it happens. Generated actions return entire database rows, and everything returned is serialised to the browser.
The fix. Select only the fields the page needs and check the caller’s permission inside each action.
A secret in a client component
What it looks like. An API key appears in the browser bundle or in the page source.
Why it happens. A variable was given the public prefix so the component could read it, or a secret was used inside a client component.
The fix. Move the call to the server, drop the public prefix from anything secret, and rotate the exposed key.
A finished front end and no back end
What it looks like. Pages render perfectly with sample data, and real data, logins or payments are placeholders.
Why it happens. The interface was generated first and the data layer was left as mock data to make it run.
The fix. The report lists exactly what is real and what is mocked, so you can scope the work to finish it.
Every change breaks another page
What it looks like. Regenerating one component changes the look or behaviour of pages that share it.
Why it happens. Shared components are regenerated rather than edited, and there are no tests to catch the difference.
The fix. Fix the shared components once, and add a few tests on the pages that matter.
What is a Production Readiness Review?
A Production Readiness Review is a fixed-price review of an app built with v0, carried out by Steve and Oliver Ford at Syriant.
Within 48 hours of read-only access we test your key user journeys and check database access rules, exposed keys, logins, payments and deployment. You get a report ranked by severity, a recorded video walkthrough of your own app, and a fixed price to fix what we find. It costs US$1,950, fixed, and the full fee is credited against fix work of any size.
What you get
A report ranked by severity
Every finding in plain English, ranked from “fix today” to “fix eventually”, with the evidence and the fix.
A recorded walkthrough of your app
A video of us in your own product, showing each problem as it happens. Watch it when it suits you, and share it with your team.
A fixed price to fix it
Not an hourly estimate. A fixed price for the fixes, which you can take to us, your developer, or neither.
Fix or rebuild, with the numbers
Most AI-built apps are worth fixing. If yours isn’t, we show you why, with the cost of each path side by side.
A one-page summary
For a co-founder, an investor or a buyer who wants the short version.
How it works
- 01
Tell us about your app
Which tool you built it with, roughly how big it is, and what worries you. We confirm the scope and send an invoice within one business day.
- 02
Share read-only access
NDA first, then read-only access to the code, database and hosting. No production secrets needed.
- 03
An optional 15-minute call
If you want one. Otherwise the brief you sent is enough.
- 04
Report and walkthrough in 48 hours
The clock starts when we have access. We’re in Australia, so your night is our working day.
- 05
You decide
Fix it with us and the fee is credited, hand the report to your own developer, or do it yourself.
Who does the work
Two people. Both named. Nobody else touches your code.
No account managers and no hand-offs. The two people who review your app are the two who fix it. Steve signs off every report.
Steve Ford
More than 25 years building and running software. A serial technical co-founder who has built and run his own products, and builds with AI coding tools every day.
LinkedIn →Oliver Ford
Builds production apps with AI coding tools every day, specialising in the databases, payments and integrations that turn a working prototype into a product people can rely on.
Who we’ve built for
- Luxury Escapes
- TRIBE – Travel & Events
- Daily Blooms
- Global Reviews
- Recognix
Steve was fantastic to work with from scoping through to delivery of our automated AI pitch deck. He worked quickly, delivered to an exceptionally high standard, and was highly responsive when we provided feedback or requested refinements.
He also brought valuable strategic advice to the project, helping us identify ways to improve our approach. His ability to work closely with our internal technology team enabled seamless integrations with our CRM, data warehouse and other systems.
Steve is pioneering what can be achieved with AI, and his work has helped us ensure our pitch decks are among the best in the business.
We came to Syriant with a problem we understood well and no clear idea how to solve it. Verifying event hotel and flight bookings against attendee details was slow and manual, and it needed to be fast and accurate. Steve took that starting point and built CrossChex into an AI-powered platform that solved the problem, and ultimately gave us far more than we originally set out to achieve.
Steve brought much more than technical expertise. He challenged our thinking, identified opportunities we hadn’t considered and continually enhanced the product along the way. He was patient through changes in direction, genuinely collaborative with our team and always focused on getting the best outcome.
Steve became a trusted partner throughout the project and brought expertise we simply didn’t have in-house. I genuinely enjoyed working with him, would absolutely work with him again given the opportunity, and would highly recommend him to anyone looking for both technical expertise and a genuinely collaborative partner.
Pricing
One app on one backend. If yours is unusually large, we’ll say so before you pay.
- Report and recorded walkthrough within 48 hours of read-only access.
- A fixed price to fix what we find.
- The full fee is credited against fix work of any size.
One price, whatever we find. Tell us about your app and we’ll confirm the scope before you pay.
Security and access
Read-only
We never need write access to review your app.
NDA before access
Signed before we see a line of code.
No production secrets
We don’t ask for live keys or passwords.
Access removed after delivery
You revoke it, and we confirm everything we held is deleted.
What usually goes wrong, by tool
Common questions
What is a Production Readiness Review?
A fixed-price review of an app built with AI coding tools, to find out whether it’s safe and solid enough for real users, real money and real data. We check security, data access, logins, payments and deployment, and give you a fixed price to fix what we find.
Who actually does the work?
Steve and Oliver Ford. Two people, both named on this page, and nobody else touches your code. Steve signs off every report.
What access do you need? Is my code safe?
Read-only access to your code, database and hosting, under an NDA signed before access. We don’t need production secrets, and access is removed when we deliver.
Will you tell me to rebuild?
Only if the numbers say so. We start from fixing what you have, and the report shows the cost of fixing against the cost of rebuilding.
I’m not technical. Will I understand the report?
Yes. The findings are in plain English first, the video shows each problem in your own app, and we’ll take you through it on a call if you want.
Is it really 48 hours?
Yes, from the moment we have read-only access. An unusually large app may take longer, and we’ll tell you before you pay.
Do I have to use you for the fixes?
No. The report works for any developer. If you do use us, the full review fee is credited against the fix work, whatever its size.
What if you don’t find anything serious?
Then you have it in writing from two experienced builders, which is worth having before a launch, a fundraise or a sale.
You’re in Australia. How does that work?
Your night is our working day, billing is in US dollars, and the walkthrough is recorded, so no meeting is needed.
Can I keep building while you review?
Yes. We review a snapshot, and when we fix things we show you how to keep your AI tool from undoing the fixes.
Which tools do you cover?
Lovable, Bolt, Replit, Base44, v0, Cursor, Claude Code and Codex, and apps built with any mix of them. We build with these tools ourselves every day.
Can this help with investor due diligence?
Yes. Investors increasingly ask how an AI-built product was made. For a deeper, investor-led assessment, see our Technical Due Diligence service. Technical Due Diligence →
By Steve and Oliver Ford · Last updated 10 October 2026
Find out what’s really in your app.
Tell us which tool you built it with and what’s worrying you. We’ll confirm the scope and price within one business day.