Przemysław Zalewski

Your AI‑built app has users

From an AI-built MVP to a product people pay for

The app works and the first users ask for more, but every change breaks something else. I take it from there in your code: tests, data that holds, payments, app stores and monitoring, in three‑week slices, without a rewrite.

See price and start date → Book a free 30‑min call

First slice, 3 weeks: $3,672⁠–⁠$7,452 excl. VAT · 102⁠–⁠138 h Details in the configurator →

Przemysław Zalewski

Sound familiar?

AI-built MVP problems I fix in 2026

Why does every new feature break something else in my AI-built app?

In a survey of 200 US technology leaders (New Relic, 10 June 2026), 82% had at least one production failure tied to AI‑generated code in the past six months, and 78% reported more incidents once that code ships.

I write tests on the paths your users actually take, add a staging copy and a release you can roll back, then keep shipping in three‑week slices in your own code, without a rewrite. In October 2026 I made every automatic backend deploy of an app wait for that commit’s checks, so a failing build no longer deploys.

Is the code Lovable or Claude wrote safe enough to charge for?

In Veracode’s 2026 GenAI Code Security Report, published on 28 July 2026, AI models still failed security checks in about 44% of coding tasks, a pass rate virtually unchanged since 2025, and coding-specialized models were no safer than general ones (Veracode).

I first fix what money and trust depend on: sign‑up, payments and per‑user data. Each fix becomes a test that runs on every pull request. I led an app through Google’s CASA security assessment twice, passing in January and October 2026. In 2023, unprompted, I made Google sign‑in in Sandtime reject unverified email addresses, a classic account-takeover path, and tightened email checks for Microsoft and Apple sign‑in too.

Sound like you? Book a free 30‑min call →

API keys leaked from my vibe-coded app?

GitGuardian counted 28.6 million new secrets in public GitHub commits in 2025, and commits co-authored by Claude Code leaked secrets at about twice the baseline rate (GitGuardian 2026).

I move keys to the server, rotate the exposed ones, add secret scanning to CI and put spending caps on your AI and cloud accounts, so one leaked key cannot run up the bill. In April 2026, when a proxy provider we used disclosed a breach, I noticed its warning had sat for two weeks in a mailbox no one was watching and pushed for the credentials to be rotated.

App Store rejected my AI app over sharing user data?

Since Apple’s 13 November 2025 update to App Review Guideline 5.1.2(i), apps must clearly disclose when personal data is shared with third-party AI and get explicit permission first (Apple Developer News).

I add the consent step and the privacy labels, send the model only what the feature needs and take the build through App Store and Google Play review. Patriot Mail is live on the App Store on iOS and macOS. In September 2026 I prepared Patriot Mail’s App Store privacy and accessibility labels from the code itself, mapping every declared data type to the code that collects it.

Facing one of these? Book a free 30‑min call →

Scope

What turns an MVP into a product

Releases without fear

Tests on the paths users take, a staging copy and a release you can roll back, so a new feature does not take the old ones down.

Data that holds

A schema that survives the next feature, migrations instead of manual fixes, and sources that do not fall over when a scraper breaks.

Accounts, payments and stores

Sign‑up, plans, invoices, App Store and Google Play, written so a stranger can pay without asking you how.

Monitoring, backups and costs

You hear about an error before a user does, yesterday’s data can be restored, and the hosting bill grows slower than the user count.

Process

How it works

  1. A call and a manual review

    I go through the app with you and write down what stands between it and a product.

  2. A list with hours

    Items in three groups, product, system and running it, each with hours, so you choose what matters first.

  3. A first slice in three weeks

    The items that hurt most, done in your code and released, not a rewrite.

  4. Then the next slice, or more

    More slices at the same rate, or a longer arrangement as an engineer or a business partner.

Where it fits

  • An app built with Claude, Lovable, Bolt or Replit that has real users and keeps breaking.
  • A side project people ask to pay for, with no payments or terms yet.
  • An app ready for the App Store or Google Play that nobody has taken through review.

Why a product is about 9× the work of a program

Fred Brooks drew this grid in The Mythical Man‑Month (1975): a program becomes a product at about 3× the work, part of a system at about 3× again, and both at once at about 9×. Running it (operations, security and compliance, scale) is our own third axis, roughly another 3×. So the honest range is 10 to 90 times what the first version took. AI made the first box cheap. The other boxes are still there.

Program (1×)

Works on the author’s machine, for the author’s data, when the author runs it.

Product (≈3×)

Works for anyone: tested, documented, with the edge cases handled and someone else able to maintain it.

System (≈3×)

Works with other systems: clear interfaces, integrations, the parts tested together.

Systems product (≈9×)

Both at once. This is what users mean when they say they want to pay for it.

Track record

Proof

If you only need a fix of a few hours, not a product, start with the rescue.

Patriot Mail: an AI email client through CASA Tier 2 and onto the App Store

The problem
A greenfield AI‑native email client for web, iOS and macOS, built at Sanddev, needed Google’s CASA Tier 2 security assessment before it could read Gmail, and it had to work for older people.
What I did
I was the principal engineer at Sanddev. I wrote the delivery plan, shaped the product vision and treated prompt injection through untrusted email as a design constraint before any model touched a mailbox. CASA and OWASP ASVS controls became a Playwright suite that runs on every pull request. WCAG 2.2 AA sits behind an automated axe gate.
Result
I led CASA Tier 2 to a pass in January 2026, with third-party pentest findings fixed, and led the yearly reassessment, validated in October 2026; the questionnaire turned into a check on every PR. Live on the App Store on iOS and macOS since April 2026. Text scaling to 200% and a calm‑email mode shipped for older users. At that reassessment five items came back for missing evidence; I fixed the code first, then resubmitted updated evidence, and all five were accepted on 27 October.

CASA Tier 2 iOS + macOS WCAG 2.2 AA Open ↗

See also: SaaS & MVP · Mobile & desktop apps

Sandtime.io, built at Sanddev: founding engineer, eight platforms, one codebase

The problem
A time-tracking SaaS had to live where people work: desktop tray, browser, phone and app stores.
What I did
I authored the original product vision and architecture in 2018 and made the first commit. React Native wrappers for iOS and Android, Electron for macOS, Windows and Linux, a Chrome extension, multi-tenant routing, SSO, Dockerized services, Paddle and Mac App Store subscriptions, CI/CD.
Result
Eight platforms shipped and run in production. The only engineer active in every year of the product, 8,000+ commits and close to half of all merges to trunk. In 2026 alone: 270+ tagged releases in ten months, about 99% of support answered by me, and a vulnerability disclosure program with a public Hall of Fame.

8 platforms 8,000+ commits since 2018 Open ↗

See also: Mobile & desktop apps · SaaS & MVP

Offer: Your company tool, sold to other companies (SaaS)

CASA Tier 2 turned into a Playwright suite

The problem
OAuth access to Gmail requires Google’s CASA assessment every year. A questionnaire does not stop regressions.
What I did
Each CASA and OWASP ASVS control encoded as a Playwright test. E2E and visual regression across six browser and device targets, run on every pull request.
Result
CASA Tier 2 passed, Yahoo’s OAuth review passed, and an annual chore became a continuous check.

CASA Tier 2 OWASP ASVS 6 targets

See also: TypeScript & Node.js · Mobile & desktop apps

Want the number before the call?

First slice, 3 weeks: $3,672⁠–⁠$7,452 excl. VAT · 102⁠–⁠138 h

See price and start date → Book a free 30‑min call

Good to know

Limits an AI-built MVP hits before its first paying user

Google login in Testing stops at 100 users

An External Google OAuth app in Testing is limited to 100 listed test users, and refresh tokens expire after 7 days (Google Cloud Help, Google OAuth).

Free Supabase projects pause

A free project pauses after about a week of low database activity and can be restored for up to a year. Paid plans never pause (Supabase).

Supabase retires the anon key

Supabase is retiring the anon and service_role keys by the end of 2026, and new secret keys are refused in a browser (Supabase API keys).

Apple takes 15 percent from small developers

Apple charges 15 percent instead of 30 to enrolled developers with up to 1 million USD in proceeds the previous year (Apple).

EU consumers can withdraw within 14 days

For digital content the withdrawal right stays unless the consumer gave express consent and acknowledged losing it (Directive 2011/83/EU art. 16).

VAT moves to the customer’s country above 10,000 EUR

Above 10,000 EUR a year of cross-border consumer sales in the EU, VAT is due in each customer’s country through OSS (Your Europe).

FAQ

Questions

An agency quoted us. Can you check the quote first?
Yes. 4 to 8 hours, $180⁠–⁠360 excl. VAT: the estimate line by line, the risks nobody priced, what can leave the MVP and whether the team plan matches the scope, in writing. Book the call and bring the quote.
What does productizing an MVP mean?
Taking a working prototype to the point where strangers can rely on it and pay for it: tests, durable data, payments, monitoring and support. In Brooks’ terms, the road from a program to a programming systems product.
Do we have to rewrite the app?
Usually not. Most of it stays, and the slices add tests, fix the data model and replace the parts that keep breaking.
What does it cost?
A three‑week slice is 102 to 138 hours, priced before it starts at the rate in the configurator. You see the list with hours first and pick what goes in.
Where do 9× and 10 to 90× come from?
Nine times is Fred Brooks, The Mythical Man‑Month, 1975. The range of 10 to 90 times is our own estimate once you add running the product: operations, security and compliance, scale.
Can’t AI do this part too?
It writes the code faster, and I use it every day: in 2026 about two thirds of merged pull requests across two products I work on were built with coding agents, and nearly all went through my review or merge. It does not decide what the product must guarantee, and it does not answer the phone when payments stop.
What if the first slice does not go well?
You can stop at any time and keep everything done so far, because the code is in your repository from the first commit. Paid work starts only after your written yes to a scope that says what “done” means, and nothing is billed above the agreed cap without asking.
You are one person. What if you get sick?
You hear from me as early as I can see it, and the work waits without harm: code in your repository, decisions written down, a runbook. Every project ends with a handover someone else can run from. No subcontractors, so nobody you have not met touches your code.
My project is small. Can you just help?
One small project a month, a few hours, for free or in exchange for a reference: a public review and permission to show the project as a case study.
Why do my beta users get logged out of Google login every week?
An External app in Testing gets refresh tokens that expire after 7 days and is limited to 100 test users (Google OAuth, Google Cloud Help). Publishing the app removes those limits.
Can I launch a paid product on Supabase’s free plan?
A free project pauses after about a week of low use, which a paying customer would notice. Paid plans never pause (Supabase).
Why does every new feature break something else in my AI‑built app?
In a survey of 200 US technology leaders (New Relic, 10 June 2026), 82% had at least one production failure tied to AI‑generated code in the past six months, and 78% reported more incidents once that code ships. I write tests on the paths your users actually take, add a staging copy and a release you can roll back, then keep shipping in three‑week slices in your own code, without a rewrite. In October 2026 I made every automatic backend deploy of an app wait for that commit’s checks, so a failing build no longer deploys.

In 30 minutes you will know if we are a fit

You bring the problem, I bring the questions. Want a number first? The configurator shows hours, a price range and the start date.

Book a free 30‑min call Email me instead

or write to ciunkos@gmail.com

After you book you get a calendar invite. Nothing else to fill in.

My pledge

  • Reply within 24 hours. I reply within 24 hours on working days, personally, not a bot. Weekend messages: by Monday noon.
  • Late means free. If I am late, the first hour of work is free. You do not have to ask.
  • Scope in writing within 24 hours. A free 30‑minute call with no company deck, then the scope and the price in writing within 24 hours. You decide.
  • The person who does the work. You talk to the person who does the work. No sales layer, no handoff.
  • Follow‑up only with news. I follow up only when I have something new for you. Never a “did you see my offer”.
  • Honest “not a fit”. If I am not the right person, I say so on the call and point you to someone who is.

Calls this week · work can start now · B2B contract · Wrocław, Poland (CET), remote

You own the code, domain and accounts from day one. Nothing is held hostage.