40M
Migrating 40 million comments without losing one
A full migration of the comment platform behind a high-traffic publisher, with instant rollback.
- typescript
- nextjs
- kubernetes
- stripe
You built it fast with AI — Lovable, Bolt, v0, or straight from the terminal with Claude Code or Codex — and then the usual thing happened: 80% of the app appeared in days, and the last 20% has eaten weeks. Every fix breaks something else, credits burn in loops over the same error, and the app works in the preview but not once you publish it. That is not you failing; it is what these tools are: excellent at starting an application, poor at finishing one.
The failures follow patterns. Apps from Lovable, Bolt or Base44 usually break at the boundary with the real world: authentication that signs you in fine on the preview and redirects to an error on the real domain, Supabase RLS policies that read like protection and enforce nothing, a Stripe or OpenAI key sitting in browser-readable code. Apps built with Claude Code, Codex or Cursor break differently: the code runs on your machine, but nobody has decided where it deploys, how it updates without fear, who takes the backups, or what happens when the server restarts. Either way the symptom is the same — you do not dare put it in front of users or charge money for it.
Our job is to finish it, not to judge it. Everything starts with a fixed-price audit: 450 EUR, 48 working hours, and a written report of what works, what is broken, what is a genuine security risk and what each fix costs. You decide with facts on the table: continue with us, fix it yourself with the list in hand, or stop. If you continue, the audit fee is deducted and the rescue runs as a fixed-scope quote — typically between 1,500 and 6,000 EUR — starting with whatever blocks launch or exposes data, then whatever blocks growth.
We do not rewrite from scratch unless the numbers justify it, and you get that justification in writing. What the AI built well stays; the behaviour your users already know is pinned down; the rest is repaired area by area while the app keeps running. At the end there is an app deployed somewhere serious, with a domain, backups, real authentication and an ordered repository that any developer — human or AI — can continue without archaeology.
And production is not where we disappear: ongoing maintenance exists as its own service, with updates rehearsed before they touch production and someone answering when something breaks. We are a Spanish studio (Vibra Lab S.L.) working remotely across Europe and beyond, in English, in writing by default and on calls when they help.
The specifics
40M
A full migration of the comment platform behind a high-traffic publisher, with instant rollback.
30,000
A production training game preparing an entire workforce on a new product, 13 days before it went public.
Native
A native application for Windows, macOS and Linux from a single codebase, with the tax data on the user machine rather than on a server.
30,000
Search, communications and peer recognition inside a large employer internal platform.
24M
Frontend, performance and production reliability on a real-time pricing platform.
Stripe
A SaaS ticketing platform built end to end, with Stripe payments and seat allocation that holds under concurrency.
How we work
The same process on a three-week engagement and on a two-year platform.
One session to understand the business process, not to show templates. We leave with priorities and a phased price.
Data model, integrations and a performance budget before the first screen is written.
Weekly releases to an environment you can visit. What gets approved gets deployed, it does not pile up.
Monitoring, verified backups and deployments anyone on the team can run.
The audit is a fixed 450 EUR (about $500) and lands within 48 working hours: what works, what is broken, what is a real security risk, and what each fix costs. If you continue into the rescue, the audit fee is deducted. A typical rescue lands between 1,500 and 6,000 EUR as a fixed-scope quote; anything outside that range is flagged in the audit, not at the end.
No — unless keeping it genuinely costs more than replacing it, and we justify that with the audit in hand. The normal path is to keep what the AI got right, pin down the behaviour your users already rely on, and fix area by area: first whatever blocks launch or exposes data, then whatever blocks growth. Your work is finished, not thrown away.
The output of any of them: Lovable, Bolt, v0, Replit, Base44, and apps generated with Cursor, Claude Code, Codex or Windsurf. Underneath there is almost always React, Next.js, Supabase or a Node or PHP backend, which is what we build with daily. The tool that generated the code matters less than the state the code is in and what it still needs to survive production.
That is the single most common failure we see. Previews forgive what production does not: environment variables that do not exist on the final domain, auth redirects pointing at the wrong URL, unverified Stripe webhooks, Supabase RLS policies that look right and protect nothing. Each has a concrete cause and a concrete fix, and finding them is exactly what the audit is for.
Most AI-generated apps we look at ship with at least one serious hole: permissions enforced only in the interface, API keys readable from the browser, or Supabase tables with RLS disabled. Every audit covers authentication, server-side permissions, secrets and exposed data. And because we are an EU company, GDPR is not an afterthought: where your users' data lives and who can read it is part of the same review.
Next step
We reply within one business day with a phased scope proposal, or with the reason we are not the right studio for it.
We use one analytics cookie to see which pages get read. No advertising, no profiling, and nothing is set without your permission. Read the cookie policy