An Xfaang service

You built the app with AI. We'll finish it for production.

Vibe coding does the fun 80%: a working frontend in a weekend. A product is the boring 20%: security, payments, GDPR, monitoring and store publication. Xfaang finishes exactly that. We don't judge the code. Your idea proved itself, we make it durable.

Book the audit for €425 / $425

Net price, fixed. 5 working days, a 60-point report and a repair quote. The audit fee counts 100% toward any package.

Prefer to just write? is@xfaang.com. A link to the app and repo access is enough.

$ xfaang audit ./your-app
✓ frontend ......... 80%
✗ auth ............. holes
✗ payments ......... test mode
✗ backups .......... none
✗ GDPR ............. none
✗ store release .... none
→ 34/60 points left to finish

~25%of App Store submissions get rejected. Almost always over paperwork, not code.

12 × 14testers times days of continuous closed testing Google requires from personal accounts. Organization accounts are exempt.

60points on our production-readiness checklist. Every audit ends with one number and a priority list.

What's left unfinished

The same gaps come back in almost every vibe-coded app. That's no accident but a systemic trait of AI-generated code: models replicate patterns from public repos, pull in unreviewed dependencies, and the pace removes the friction that normally catches mistakes.

Security

API keys in client code, no RLS, open endpoints, no input validation

Auth & accounts

broken password reset, no email verification, no account deletion

Payments

Stripe in test mode, ignored webhooks, no invoices or VAT

Legal & GDPR

no terms of service, privacy policy or cookie consent

Infrastructure

deploys from a laptop, no staging, CI or database backups

Reliability

silent failures, zero logs, no monitoring or alerts

API costs

LLM keys with no spending caps

Code quality

zero tests, AI duplication, hallucinated packages

UX

broken mobile, missing loading and error states

Email

sent from a personal Gmail, no SPF or DKIM, everything lands in spam

Documentation

env vars in one person's head, bus factor of 1

Publication

the app never reaches the App Store or Google Play

How we work

We always start with an audit, because vibe-coded apps vary wildly and nobody honest can quote a repair blind. After the audit you get a fixed price for one of three packages. We work in your repo, everything stays yours.

34/60 This is what an example audit result looks like. One number and a priority list.

Security & supply chain	4/12
Payments & invoicing	1/8
Infra, backups, monitoring	6/12
Legal & GDPR	2/8
UX, email, performance	9/12
Store readiness	2/8

The score works for one app over time. We don't compare apps to each other, because they differ in stack and purpose.

0. The "Punch List" audit

€425 / $425 net · 5 days

A full review of the repo and the live app against 60 points: security, supply chain, auth, payments, infra, GDPR, API costs, store readiness. You get a prioritized report and a fixed quote for the packages.

Counts 100% toward any package.

1. Make It Safe

€2,225 / $2,225 net · about a week

Only the dangerous parts: secret rotation and moving them server-side, patched auth holes, RLS and endpoint authorization, rate limiting, spending caps, backups, Sentry and monitoring.

Result: nobody breaks in, the app doesn't die silently.

2. Make It Ship

€6,225 / $6,225 net · 2 to 3 weeks

Everything in Make It Safe plus payments end to end with webhooks, invoices and VAT, GDPR and legal pages, email deliverability, finished UX states, a performance pass, and staging plus CI/CD with tests on critical paths.

Result: you charge customers and sleep well.

3. Take It Over

from €12,250 / $12,250 net · quoted after the audit

For apps with real traction and code beyond saving. We refactor or rewrite the worst modules, add tests on key flows, documentation and an architecture that survives growth. Optionally Xfaang becomes your engineering team.

Result: a foundation that survives growth.

Pricing

Fixed net prices, no day rates and no open-ended billing. The audit fee always comes off the package price.

Scope	Net price	Time
The "Punch List" audit, 60 points, report and a fixed quote	€425 / $425	5 days
Make It Safe, security and stability	€2,225 / $2,225	~1 week
Make It Ship, ready to sell	€6,225 / $6,225	2-3 weeks
Take It Over, rewrite and takeover of development	from €12,250 / $12,250	after the audit
Get It Published, App Store or Google Play	€1,725 / $1,725	2-4 weeks
Get It Published, both stores	€2,475 / $2,475	2-4 weeks
Keep It Alive, retainer: monitoring, updates, CI guardrails	€500-975 / $500-975 / mo.	ongoing care

Get It Published requires at least the Make It Safe package. We won't put our name on publishing a leaky app. The retainer includes guardrails that let you keep vibe coding: our CI blocks AI-generated changes before they break production.

App Store and Google Play publication

Publication is a discipline of its own and vibe coders trip over it all the time. Apple rejects roughly a quarter of submissions, almost always over paperwork: a missing privacy manifest, a description that doesn't match the app, a demo account that won't log in, the wrong target API.

Under Get It Published we run the whole process: accounts and strategy with the personal vs organization decision, technical compliance with Android 16 / API 36 (required from August 31, 2026), the AAB format, Play App Signing, Play Integrity and the iOS 26 SDK (from April 28, 2026), declarations covering Data Safety including data collected by third-party SDKs, the privacy manifest and App Privacy, the listing with graphics, screenshots and ASO copy, and review with a demo account for the reviewer. We pilot every rejection at no extra cost until the app is live in the store.

One thing worth knowing before you start: Google requires personal accounts to run a closed test with 12 testers for 14 uninterrupted days. Organization accounts are exempt. That one decision can cut publication time by over two weeks, which is why we quote the timeline honestly: 2 to 4 weeks from build handover to live.

Finishing, in eight questions

What does finishing an app mean?

Taking a working prototype to product state: security, payments, legal, monitoring, publication. We fix what the AI didn't do and what users and app stores require.

Who is this for?

Vibe coders, no-code builders and founders who built an app with Cursor, Claude Code, Lovable, Bolt or v0 and want to actually sell it, not just demo it.

Why do you start with an audit?

Because vibe-coded apps vary wildly and quoting a repair blind would be guessing at your expense. The audit costs €425 / $425 net, takes 5 days and comes fully off the package price.

Do you judge my code?

No. Your idea proved itself: the app works and people want it. Our job starts where the fun ends, in the boring 20% that turns a prototype into a product.

Can I keep building the app myself afterwards?

Yes, that is the whole point of the Keep It Alive retainer. We leave guardrails: CI with tests, scans and linting that blocks AI-generated changes before they reach production. You keep vibe coding, we make sure nothing blows up.

How long does App Store and Google Play publication take?

Realistically 2 to 4 weeks from build handover. Google requires personal accounts to run a 14-day closed test with 12 testers, first Apple reviews usually take 3 to 7 days, and Google up to 7-10 working days. Anyone promising publication in a week is bluffing.

What if the app can't be saved?

We tell you after the audit, not after the invoice. Then Take It Over kicks in: we rewrite the worst modules or the whole thing, keeping what works. The repair-or-rewrite recommendation is part of the report.

Which stacks do you cover?

The typical vibe-coding stack: Next.js and React, Supabase, Firebase, Node, Python, Stripe, Vercel, React Native and Expo. A different stack? Write to us and we'll tell you straight whether we take it.

This page passes its own audit

We sell finishing, so this page is finished. Every point below can be verified from the outside, without asking us.

Declares Organization, Service, OfferCatalog with prices and FAQPage in JSON-LD. View source and read them.
Prices live in text, not in images. Everything an AI engine has to read is text.
Zero JavaScript and no build step. The only external assets are fonts and the logo from xfaang.com.
A visible last-updated date in the footer.
Hides nothing from AI crawlers. Humans, Google and ChatGPT read the same thing.

Next step

Send a link to the app and repo access. Within 5 working days you get a 60-point report, a priority list and a fixed quote. Then you decide.

Book the audit for €425 / $425

Ignacy Szczupał · is@xfaang.com · +48 600 648 489
Piotr Zientara · pz@xfaang.com · +48 600 939 076