More riding on your software? Find what would break first.

The $149 check includes one small fix, about an hour's work. Anything bigger is quoted separately: one fixed price for the blockers you choose, agreed before you pay, and the $149 comes off it if you book within 14 days.

1. A date is coming and you don't know if it's safe. Launch Blocker Check, $149, in 1 business day. I run the standard security tools over your code and its history and read the places launch blockers usually sit: database rules, server functions that don't check who's calling, keys sent to the browser and how payments are confirmed. You get everything I find that would stop a safe launch, most urgent first, each with where it is, why it matters and the first step to fix it, a 20-minute call, and the one you pick fixed if it's about an hour's work. The $149 counts in full toward any fix you buy within 14 days. How the check works →
2. You want the rest fixed, not just found, and a straight answer on whether to launch. Fix the list, one fixed price for the blockers you choose. After your check, you pick which of the other blockers you want fixed. I quote one fixed price for the whole list on our call, or within 1 business day after it, and tell you how long it'll take. You pay only after you approve the list and the price. Before I start each fix, you approve its test. At the end, I retest everything and give you a plain "launch" or "not yet", signed and dated, naming the exact version of your code it covers. The $149 comes off the price if you book within the check's credit window: 14 days from the list, as the check page explains.

Fix the list gives you:

1. Each blocker you chose, fixed, with the plain test you approved passing. If I can't make one work, I tell you the same day and refund that fix's share of the price, which the quote lists.
2. A retest of everything at the end, and a plain answer, based on what I checked: "launch" or "not yet". I sign and date it, and it names the exact version of your code it covers. If I couldn't check something, I say what and why. It's my judgment on that version on that day, not a promise that nothing else is wrong.
3. A handover note: what was done, what's still open and what to watch.

You already know the one thing that's wrong. Fixed-price jobs, $300 to $500, quoted before I start, each done in 2 to 3 business days with before-and-after proof:

• Users can see each other's data. Database rules locked down: your Supabase access rules (row-level security) written for every table with user data, with a test that shows user B reading user A's rows before the fix and refused after it.
• Payments go through but your app misses some. Stripe payment notifications reviewed: your app checks that each notice really came from Stripe, handles a repeat without a double charge or a duplicate order, and records failures where you'll see them, proven by replaying each event in Stripe's test mode.
• A key got out. A leaked key replaced and its limits set: a new key issued, the old one revoked in an order that keeps your app running, the new key limited to what your app needs, with a spending cap where the service offers one, and a check that stops the next one being committed.

What the fixed prices cover: one app with one database of up to 12 tables, the kind a single builder project creates. If yours is bigger, I'll tell you the price before you pay anything. Built in a no-code tool without a code export, like Bubble? Tell me first and I'll say whether I can work on it. Before you pay, I'll give you a start date, the earliest I have free, and hold it for 3 business days while you decide. The business days count from that date, once I have what the job needs.

What I'll ask you for: the code (read access to your GitHub repository, or an export from your builder). For Fix the list, I'll also say exactly what edit access I need before we start, and ask for a test login if a fix needs one, ideally one ordinary user and one admin. For Fix the list, read-only access to your database and hosting settings helps but isn't required. If your database holds real customer or patient records, we set up a test copy with made-up data instead, so I never see real records. I'll send step-by-step instructions, and I never need live keys.

See a sample report → A full written read of a public open-source Lovable app, anonymized.

These are the eight areas I look at when I read an app. The $149 check reads the ones tagged as in the check: security, access to accounts and, from reliability, how payments are confirmed. The sample report shows a full read across all eight. For the check I read your code, plus any Security Advisor results you paste. For fixes beyond the check, I test with accounts you set up for me. I don't attack your live app or touch real user data unless you've agreed in writing first.

1. B.1SecurityIn the check

   Secret keys in the code or sent to visitors' browsers. Database rules (in Supabase, row-level security) that let one user read or change another's data. Server code that trusts whatever the browser sends. Libraries with known security holes (outside the $149 check, which doesn't scan them).

2. B.2Sign-in and accountsAccess in the check

   Sign-up, login, password reset and logout, and whether a user can reach records or admin tools that aren't theirs.

3. B.3Data and privacy

   What personal data the app collects, where it's stored, who can read it, which outside services get it, and whether you can delete it or restore from a backup.

4. B.4ReliabilityPayments in the check

   What happens when a payment, email or AI service fails or runs slowly, whether you'll see the errors, and whether orders can be lost or charged twice.

5. B.5Deployment

   How a change reaches your live app, where keys are kept, how fast you can undo a bad release, and whether you could run the app without your builder.

6. B.6Cost risks

   Paid services any visitor can trigger with no cap, and plans that will bill you unexpectedly as you grow.

7. B.7AI features and agents

   If your app uses AI: what it can see and do on a user's behalf, whether a message, email or web page can trick it into doing something it shouldn't, and whether actions that matter wait for a person to approve them.

8. B.8Code health

   How hard the code will be to change safely, and what's most likely to break next.

How deep each area goes depends on the job and the access you give me, and I say plainly what I couldn't check. It's a read of your code (and, for fixes, the settings you show me), not a penetration test, legal advice, a compliance certificate or a promise that the app has no bugs.

Fixes and builds get a fixed price before I start. When nobody can price the job before a first look, I work by the hour instead.

• Each item comes with a plain test of what "fixed" or "done" means, for example "when user B asks for user A's orders, they get an error". You approve the tests first.
• If you built it with Lovable, Replit or Bolt, you keep building there afterwards: I make changes so they sync back, usually through its GitHub connection. If your builder can't take outside changes cleanly, I'll say so in the quote, before you pay.
• You get a handover note: what was done, what's still open and what to watch.
• Anything new gets its own short quote, or your yes before it counts against an hourly cap. I won't quietly grow the job or the bill.

First versions, quoted per project: if you haven't built it yet, I can build the first version for you. Tell me what it has to do, and before I start I'll quote a fixed price and a finish date, and say whether it's meant for real users or as a prototype to test the idea.

Small builds, from $175: a script, a spreadsheet automation, a browser extension or a connection between two tools you already use.

By the hour, $150 an hour, with a cap: for ongoing work with your team, or for a job I can't price until I've seen the code. You set a budget cap, I bill my hours against it, and I check in before I reach it. I won't go past it without your yes. Each invoice lists the hours worked. Security reviews start with a capped security first look instead.

You pay only after you've approved the scope. Before you pay, I tell you what's covered, the price (for hourly work, the rate and the cap) and the start date. Before I start each fix, you approve its test. If you pay for the $149 check before I've confirmed it fits, and it doesn't, I refund it in full.

If I can't make a date. If I'm ill or something outside my control stops me, I'll tell you that day, and you choose a new date or a full refund.

My builder or ChatGPT already scans my code. Why pay you?

Run it; it'll catch some things. A scanner gives you a list, sometimes with draft fixes. I add judgment on what matters for your app and your launch, confirm every finding myself and give you one fixed price to fix the ones you choose. With Fix the list, I also make those fixes and retest everything. In the sample report, the finding that looks scariest to a scanner mattered least, and the real risk was a database rule that depended on one dashboard setting.

My app handles health or other personal data. Can you work on it?

Yes. I work from test data, never real patient or customer records, and we'll agree how your data is handled before I start. I don't provide compliance certification. I don't sign business associate agreements (BAAs): I never see patient records, so if your rules require a BAA from anyone who sees your code, I'm not the right fit. For any other data agreement, send it first and I'll tell you whether I can work under it.

I run a studio or agency. Can you review client work?

Yes. I can deliver the check's list unbranded and without my fix quote, so you price the fixes. I never contact your clients, and we can arrange pricing for repeat work.

What happens to my code?

I keep it confidential, and I'll sign your NDA once I've checked it allows the AI tools I use. I use AI coding tools (Claude Code and OpenAI Codex) to read code faster. Before I use them on your code, I check that their model-training controls are switched off, including Codex's separate Include environments setting. Your production database and your users' records never go into them, and within 7 days of the job ending (14 days after I deliver), I delete my copies of your code and data and the session logs my AI tools keep for your project, and tell you when it's done. I keep what I sent you, our emails and a record of which version of the code I handed over. Codex also keeps a shared history on my computer that can't be cleared for a single project, so parts of what it read can stay there. The check needs no keys at all; for a fix job, please send test keys, not live ones.

Can I stop partway, or ask about a charge?

Yes. You can end a job at any time by email. You pay for the work done up to then, measured against the quote (or the hours worked, for hourly work), and I refund anything you've paid beyond that. Refunds go back to the card or bank account you paid from. Questions about a charge? Email bryce@watsonstandardco.com.