"How much to make this production-ready?" is the question we are asked most, and the honest answer is a range, because the work is scoped by what your prototype already does rather than by how big it looks.
So here is the range, what moves it, and how to work out roughly where you sit before you talk to anyone — including us.
What you are actually paying for
Four distinct things, usually bundled into one invoice:
- Finding out what is wrong. A read of the codebase against a list of failure modes. Cheap, fast, and the only part that is genuinely hard to do yourself, because it depends on having seen a lot of these.
- Closing the security gaps. Row Level Security, secrets, function auth, input validation. Non-negotiable, and the fastest work per unit of risk removed.
- Making it hold under load. Indexes, constraints, query shape, bundle size. Scoped by your data model, not your page count.
- Making it operable. Pipeline, environments, monitoring, alerts, rollback. Nearly fixed-cost — it is roughly the same work whether the app is small or large.
Point four is why very small projects rarely come in under a floor. The operational scaffolding a five-page app needs is not much less than what a fifty-page app needs.
The ranges
What this work costs across the market, as of 2026:
| Work | Typical range | What you get |
|---|---|---|
| Readiness audit | $300 – $800 | A prioritised findings list you keep |
| Security-only pass | $800 – $2,500 | RLS, secrets, auth, validation closed |
| Full production sprint | $2,400 – $8,000 | Audit, refactor, deploy, monitoring |
| Rebuild on a clean foundation | $12,000 – $40,000+ | New architecture, tests, docs |
| Ongoing support retainer | $400 – $1,500 / mo | Monitoring, fixes, tuning |
Our own numbers sit inside those bands — a $450 audit credited against the sprint that follows, sprints from $2,400, retainers from $490 — and are on the pricing page with what each includes. We are listing the market range rather than only ours because the useful thing to know is whether a quote you have in hand is reasonable.
What moves the number
| Factor | Cheaper | More expensive |
|---|---|---|
| Codebase size | Under ~10k lines | Over ~40k lines |
| Auth model | One role | Teams, invites, per-row sharing |
| Payments | None, or Stripe Checkout | Subscriptions, proration, refunds |
| Data model | Sound, needs indexes | Wrong shape, needs migration |
| Integrations | Two or three | Ten, several undocumented |
| Existing tests | Some | None, on the money path |
| Live customers | None yet | Yes — every change needs care |
| Compliance | None | GDPR / HIPAA / SOC 2 in scope |
Two of these dominate. A data model that is wrong rather than merely unindexed means a migration, and migrations with live data are careful, reversible work. Live customers roughly doubles the cost of every change, because nothing can break while it happens.
The single biggest discount available: bring us in before you launch. Same work, no migration, no downtime window, no support tickets.
What skipping it costs
The comparison is not "spend or save". It is "spend now or spend later", and later is priced differently:
- An exposed database. Support, disclosure, and the customers who leave. Under GDPR, a notifiable breach starts a 72-hour clock. There is no version of this that costs less than the sprint.
- A leaked metered key. We have seen a single exposed AI key run to five figures over a weekend. Budget caps exist because this is common.
- Launch-day collapse. The one day you will ever have that much attention. A crash spends it.
- Compounding slowness. Every feature on a foundation that cannot hold takes longer than the last. This is the expensive one, because it is invisible: you do not get an invoice, you just stop shipping.
- Your own time. Twenty hours across a fortnight debugging production is not free, and it is the fortnight you were going to spend selling.
Versus the alternatives
Hire a senior engineer. $120k–$200k fully loaded, plus six to ten weeks to find one. Right when you need continuous engineering. Slow and expensive when you need three focused days.
Learn it yourself. Genuinely viable, and the cheapest in cash. The costs are time — weeks, not days — and that you cannot easily audit your own blind spots. Which is why the checklists on this blog are free: the launch checklist we run before any AI-built app goes live is the same one we use internally. Run it yourself and you will close real gaps.
Rebuild from scratch. Almost always the wrong answer, and we say so on the features page too. You throw away working product-market fit to fix problems that are mostly fixable in place. We recommend it maybe one time in twenty, when the data model is unsalvageable.
A general agency. Fine work, usually priced for a project rather than a hardening pass, and usually keen to rebuild — because rebuilding is easier to scope than reading someone else's generated code.
Working out your own number
Answer these six honestly:
- Is Row Level Security enabled with real policies on every table?
- Is every secret key server-side?
- Is there an index on every column you filter, sort, or join on?
- Would you find out about a checkout failure without a customer telling you?
- Can you roll back to yesterday's version in under five minutes?
- Are there tests on the path where money moves?
Count the noes.
| Noes | Where you probably sit |
|---|---|
| 0–1 | An audit, and a day of tidying |
| 2–3 | A security pass, $800–$2,500 |
| 4–5 | A full sprint, $2,400–$8,000 |
| 6 | A sprint, and possibly a data-model conversation |
Most AI-generated codebases we see answer no to four or five on first pass. That is not a judgement on the tools or on you — it is the predictable distance between "it works" and "it holds", and it is a normal amount of work.
Getting an actual figure
A range is only useful up to a point. For a real number someone has to read your code, which is what the free 15-minute launch audit is for: we look at the repo, tell you what is risky, and give you a fixed price for the work. If the paid audit does not surface at least three concrete improvements, it is free — and the fee comes off whatever you do next.
No pitch, no obligation, and you keep the findings either way.
