Przemysław Zalewski

Rescue for AI‑built apps

Built it with AI. Stuck before launch?

The app almost works. The agent keeps fixing one thing and breaking another, the deploy fails, or login only works on your laptop. I take it from there: a 30‑minute call, access to the repo, then 2 to 8 hours at a fixed price until it builds, deploys and does what it should.

See price and start date →

2 to 8 hours: $72⁠–⁠$432 excl. VAT, price fixed before we start.

Przemysław Zalewski

Sound familiar?

AI-built app problems I fix in 2026

Did my AI-built app leak API keys?

GitGuardian counted 28.6 million new secrets in public GitHub commits in 2025, and commits co-authored by Claude Code leaked them at about twice the baseline rate (State of Secrets Sprawl 2026). Every call made with a leaked AI key lands on your bill until someone rotates it.

I move keys out of the frontend to the server, rotate the ones that leaked and add a check that blocks the next commit with a secret in it. You get a list of what was exposed. In 2025, unprompted, I found and removed logging of credentials and form data that nobody had noticed.

The AI agent deleted my production database. Now what?

In April 2026 a Cursor agent running Claude deleted PocketOS’s production database and all its backups in nine seconds, causing a 30‑hour outage, an incident logged by the OECD. Any agent that can reach production credentials can do the same.

I restore from the newest backup or point‑in‑time copy you have, then split development data from production, take production credentials away from the agent and keep backups out of its reach. If there is no backup, I say so on the call and we set one up first. When a change of mine once corrupted records in production, I rolled it back and rebuilt the damaged rows from the transaction log instead of restoring a whole backup, with zero downtime.

Is my vibe-coded app safe enough to launch?

Veracode’s 2026 GenAI Code Security Report, published in July 2026, tested more than 100 models and found the average security pass rate stuck at 56%, so generated code fails security checks in about 44% of tasks. Models got better at writing code that runs, but no better at writing secure code.

While I fix what blocks the launch, I close missing access checks and unescaped inputs on the paths I touch and pin each fix with a test. A full security review is not part of a rescue. In October 2023, before a B2B platform’s public early access, I caught a chart library with a license that did not fit, led the move to a compatible one, and added the consent dialog, cookie and privacy policy, so the launch was clean.

Facing one of these? Book a free 30‑min call →

What is usually wrong

The build fails after an update

A dependency moved, the agent upgraded half of the project, and now nothing compiles.

The deploy ships the wrong thing

The hosting serves source files instead of the build, or the environment variables never made it to production.

Login only works locally

Redirect URLs, cookies or the auth provider settings still point at localhost.

The agent made it worse

Each prompt fixes one bug and adds two. The history is a pile of “fix fix fix” commits.

Data goes to the wrong place

Forms save nothing, or save twice, or the table the app reads is not the one it writes.

It has “almost worked” for a week

One feature is 90% done and the last 10% keeps sliding.

How it works

  1. 30-minute call

    You show me the app and what should happen. I tell you if it is a few hours or a bigger job.

  2. Access to the repo

    GitHub (export from Lovable or Bolt first), the hosting and a test account. Nothing on your personal logins.

  3. 2 to 8 hours of work

    Fixed price for the hours you pick in the configurator.

  4. A pull request and a recording

    The fix with a plain description of what was wrong, a list of what is likely to break next, and a 10‑minute video on how to keep it working.

What I do not do here

  • Rewrite the app from scratch.
  • Work inside your Lovable or Bolt account without a GitHub export.
  • Promise a fix date before I have seen the app.
  • Security reviews or audits. This is about getting the app unstuck.

Or take it over completely: the takeover week

When the app runs the business but only its author knows how, a few hours are not enough. In five days I move it to company ownership, so it no longer depends on one person.

  1. Accounts to the company

    Domain, hosting, database, code repository and paid services moved to company ownership, with a second person who can log in.

  2. Deploys from the repository

    One way to ship a change, from the repository, that anyone on the team can repeat.

  3. A runbook and a restored backup

    How it runs, how to deploy and undo, and one backup actually restored to prove it works.

  4. The first fix shipped

    The most annoying thing on your list, fixed. Then optional monthly care.

See takeover week price and date → Start with the free runbook generator

Why me

I build with coding agents every day, under rules I wrote for them. In 2026 about two thirds of merged pull requests across two products were built with agents, and nearly all went through my review or merge. In 2026 alone: 260+ merged pull requests of my own and 300+ reviews of other engineers’ work. Since 2009 I have shipped 25+ apps with 3.7M+ downloads. I know the ways agents get stuck because I spend my days getting them unstuck.

An AI coding agent as a team member, under enforced rules

The problem
Coding agents write code faster than a team can review it. A team of four wanted the speed without a slop swamp on main.
What I did
I authored the rule set shared by Claude Code and Codex: mechanical checks over written rules, lint and test gates for security, API surface and CSP, agents working on main with hooks, every PR reviewed by a human, AI‑assisted content disclosed as such.
Result
In 2026 about two thirds of merged pull requests across two products were built with coding agents, and nearly all went through my review or merge. I merged 260+ PRs of my own and reviewed 300+ of other engineers’. My commits across those two products went from under 1,000 in 2025 to 7,500+ by October 2026.

~2/3 PRs with agents 300+ reviews 7,500+ commits in 2026

See also: AI & agents · Full‑stack & custom software

Offer: AI engineer for your team (Node.js, LLM agents)

Restarting delivery after three years of maintenance mode

The problem
A mature product had drifted into maintenance. The backlog was old and the team small.
What I did
Agent-assisted development under an enforced rule set, help docs migrated from WordPress into the repo as markdown with 301 redirects and i18n, help added to the Definition of Done.
Result
From about 60 commits in 2025 to 4,800+ by October 2026, about 80× year over year, one less server to break during holidays, docs that match the product.

~80× commits YoY docs‑as‑code

See also: AI & agents · AI in your company

Help center moved from WordPress into the repo as docs-as-code

The problem
An unmaintained WordPress help site: red in audits, no sitemap, expiring certificates, plugins nobody understood.
What I did
Markdown in the repo, versioned with the product, all languages generated automatically, interlinking, 301 redirects for every old address, help added to the Definition of Done.
Result
One machine less to break during holidays, docs that match the product, better SEO and GEO, context agents can read.

docs‑as‑code 301s i18n

See also: Cloudflare · Next.js

Offer: Your company site off WordPress, in a few hours

Want it unstuck this week?

Pick the hours in the configurator, then book a 30‑minute call. You get the fix in your code (a pull request), not a report.

See price and start date → Check if it is ready for the stores

Good to know

Supabase and Lovable facts behind most rescues

New tables stop being exposed on 30 October 2026

From 30 October 2026 new tables in existing Supabase projects are no longer exposed to the Data API automatically, so a table an agent just created fails until access is granted (Supabase changelog).

Tables created with SQL start without RLS

Row Level Security is on by default only for tables created in the Supabase Dashboard. Tables created with SQL, the way agents create them, need it switched on (Supabase docs).

Views ignore RLS by default

Views usually run as postgres and bypass Row Level Security unless set up otherwise (Supabase RLS).

An UPDATE needs a SELECT policy

Supabase needs a matching SELECT policy for an UPDATE, so “save does nothing” is often a missing policy (Supabase RLS).

The anon key is being retired

Supabase is retiring the anon and service_role keys by the end of 2026; apps need to move to the new keys (Supabase API keys).

Lovable always creates a new repository

Lovable’s GitHub sync cannot attach an existing repository, and deleting the repository stops the sync (Lovable docs).

FAQ

Questions

My Lovable app is not working. Can you fix it?
Usually yes. Export it to GitHub first, so I can work on the code directly. Most fixes take a few hours.
Claude Code broke my project. What now?
Do not keep prompting. Commit what you have, then book a call. With git history I can usually find where it went wrong and get back to a working state.
How much does it cost?
$36 to $54 an hour excl. VAT, depending on difficulty, so 2 to 8 hours come to $72 to $432. You pick the hours in the configurator and see the fixed price before you book. Paid work starts only after your written yes, and you pay by bank transfer within 14 days of the invoice.
Is my code safe with you?
NDA is standard. I work in your repository and accounts, with AI training turned off, and I show nothing from your project without written consent. Everything I write is yours. Access goes through accounts you control, revocable in one click, and at the end I hand it back, delete local copies and confirm it in writing.
Will you finish my app?
If what is left fits in a few hours, yes. If it is bigger, I will say so on the call and suggest a first slice instead: from MVP to product.
Can you put it in the App Store and Google Play?
Yes, that is a separate offer. The free store-readiness check shows what is missing first.
Do you help small projects for free?
One small project a month, a few hours, for free or in exchange for a reference: a public review and permission to show the project as a case study. Book a call and tell me what you are building.
What if 8 hours is not enough, or it still does not work?
No surprise bill. The price fixed before we start is a ceiling I do not cross without asking. If I see the fix will not fit, I tell you before the ceiling is reached, show what I found and we decide together: stop and keep everything done so far, or add hours. Every change sits in your GitHub repository from the first commit.
I am not technical. Will I understand what you did?
Yes. The pull request is the fix itself, with a plain description of what was wrong and what is likely to break next, plus a 10‑minute video on how to keep it working. I answer about 99% of Sandtime.io support myself, so explaining software to the people who use it is part of my week.
My Supabase app suddenly can’t read a new table. Why?
From 30 October 2026 new tables are not exposed to the Data API automatically (Supabase changelog). Tables created with SQL also start without RLS, and an UPDATE needs a SELECT policy (Supabase RLS).
Is the Supabase anon key in my Lovable app a problem?
It was always meant to be public, but only safe with RLS on every table (Supabase docs). Supabase is retiring it by the end of 2026, so plan the move to the new keys (Supabase API keys).
Did my AI‑built app leak API keys?
GitGuardian counted 28.6 million new secrets in public GitHub commits in 2025, and commits co-authored by Claude Code leaked them at about twice the baseline rate (State of Secrets Sprawl 2026). Every call made with a leaked AI key lands on your bill until someone rotates it. I move keys out of the frontend to the server, rotate the ones that leaked and add a check that blocks the next commit with a secret in it. You get a list of what was exposed. In 2025, unprompted, I found and removed logging of credentials and form data that nobody had noticed.

In 30 minutes you will know if we are a fit

You bring the problem, I bring the questions. Want a number first? The configurator shows hours, a price range and the start date.

Book a free 30‑min call Email me instead

or write to ciunkos@gmail.com

After you book you get a calendar invite. Nothing else to fill in.

My pledge

  • Reply within 24 hours. I reply within 24 hours on working days, personally, not a bot. Weekend messages: by Monday noon.
  • Late means free. If I am late, the first hour of work is free. You do not have to ask.
  • Scope in writing within 24 hours. A free 30‑minute call with no company deck, then the scope and the price in writing within 24 hours. You decide.
  • The person who does the work. You talk to the person who does the work. No sales layer, no handoff.
  • Follow‑up only with news. I follow up only when I have something new for you. Never a “did you see my offer”.
  • Honest “not a fit”. If I am not the right person, I say so on the call and point you to someone who is.

Calls this week · work can start now · B2B contract · Wrocław, Poland (CET), remote

You own the code, domain and accounts from day one. Nothing is held hostage.