We built our product with AI tools. Is it production-ready?

Maybe. AI tools are good at code that runs, and weak at code that is safe. The usual gaps are access control, exposed keys, customer data that is not walled off, and no way back after a bad release. The Review tells you which of these you have, and what each fix costs.

Are you going to tell me it all has to be rebuilt?

Only if a rebuild is cheaper, and the report shows the cost of both paths so you can check. The verdict is written down with evidence, not opinion.

Will you try to sell me the fix?

I can lead the fixes, and I say so up front. Two things keep the verdict honest. The Review fee is not credited against any later work, so no discount pulls the answer one way. And the roadmap is written so your team, a new team or I can do the work. If a fix is cheaper than a rebuild, the report says so.

My developers will see this as an attack.

The report names no people and assigns no blame. It lists fixes in order, each with a scope and an estimate, so your developers can start the next day. Your team keeps shipping during the Review.

Will this get us through due diligence or an audit?

The Review checks the same list the investor's adviser or the auditor uses. You go into that meeting with an answer you can show, not one you hope is true. Nobody can honestly guarantee the outcome of a round, and I will not.

What access do you need, and who owns what?

Read-only access to the code, the cloud account and the database, from a one-page checklist. No code or data leaves your accounts. The code, the IP and the report are yours. You remove my access when the Review ends.

We cannot stop development. We have a deadline.

You do not need to. The Review is read-only and runs next to your team. If your deadline falls inside the two weeks, the fixes that matter for that date come first.

What if the product is fine?

Then the report says so. That is worth the fee on its own. It is the only version of “fine” you can show an investor.

There are code audits from $199. Why pay more?

Some of them are good, and for a small app one may be enough. Before you choose, ask three things. Who reads the code, and have they led a product through an audit themselves? Do you get a fix-or-rebuild verdict with the cost of each path? Is there a summary you can send to an investor as it is? The Review gives you all three.

Should we just get SOC 2 instead?

If a customer contract requires it, yes. The Review does not replace it. But SOC 2 checks the process, not the architecture. A badge on a system that leaks data between customers is the same problem at a higher price. With a Review first, the SOC 2 auditor checks controls that already work, not gaps you find during the audit.

We have not built anything yet. Can you help?

Yes. I review the spec and the vendor proposals instead of the code: what is fair, what is padded, what is missing, and the contract terms that keep the code and IP yours.

Home

Writing

Notes on building software in the AI era

Architecture, judgment, and where AI helps versus where it quietly hurts.

July 2, 202626 min read

How I build software with AI agents: the complete setup

How I build software with AI agents without shipping their mistakes: the specs, gates, and review loops that catch the AI when it is confidently wrong.

Read

June 10, 202612 min read

AI loops, explained: the new way to build, and the part nobody mentions

Stop prompting, write loops, goes the advice. Here is how an AI loop actually works, where it breaks, and the one part it cannot supply.

Read

June 2, 202610 min read

The green build lied: the bugs AI hides behind passing tests

Every test passed and the green build looked done. More than twenty real bugs were still hiding behind it, and here is the layered review that caught them.

Read

May 27, 202619 min read

Spec-driven development in 2026: main tools overview

spec-kit, OpenSpec, BMAD, GSD, Kiro, Tessl - what each really is, and how to pick one, or none.

Read

May 25, 20269 min read

How I do architecture with AI without letting it make the decisions

A greenfield architecture workflow for the age of AI-generated code - built on OpenSpec, with guardrails that keep the AI honest.

Read

Is a deadlinecoming?

A round, an audit, a big customer, a vendor contract. Book a 30‑minute Risk Assessment Call. We go through who built your product, what must be ready before that date, and what breaks today.

Book a risk assessment call

Free. No preparation. You leave with your 3 biggest risks in writing, and an honest answer on whether a review is worth it now.