Secrets in git and the client
Agentic edits paste keys where they were convenient, a frontend file, a committed `.env`, the shell history. We scan the whole repo and git history, move every secret server-side, and rotate what was exposed.
Vibe coding rescue · Claude Code
Ship the app you built with Claude Code, safely.
Claude Code writes real, professional-grade code straight into your repo from the terminal, which is exactly why its projects get further and break harder. The agent moves fast across many files at once, and the review that would normally catch a leaked secret or a missing permission check never happened. That review is the rescue.
Businesses we’ve worked with
The Claude Code wall
Claude Code is agentic and developer-facing: it runs in your actual repository, executes commands, edits dozens of files in a single turn, and wires up MCP servers and tools. That power is real, and so is the failure mode, a large multi-file edit that lands cleanly, passes the eye test, and quietly breaks the build, changes an auth boundary, or commits a `.env` because a permission prompt got waved through. Because the work spans sessions, context is lost between them, and an over-eager refactor in week three can undo a careful decision from week one.
The security angle is the sharp one. Claude Code is happy to scaffold a whole backend, and unless someone asked for it specifically, that backend ships with secrets in the client bundle, database rules left open, auth checks that live in the UI instead of the API, and API keys committed to git history. We audit exactly this: every secret the agent touched, every table’s access rules, every endpoint’s authorization, and the git history for anything that should never have been committed. You get a prioritised list of what is exposed and one fixed price to close it before launch, not after.
What we fix in Claude Code apps.
Backend built, not secured
The agent scaffolds auth and a database that work in the demo but leave row-level rules open and permission checks in the browser. We enforce access on the server, table by table.
Multi-file edits that drift
A single big turn touches thirty files and context is lost between sessions, so a later refactor breaks the build or undoes an earlier fix. We review the whole codebase and make it coherent again.
Watch it work
From Claude Code project to live product.
Codebase audit212 files read
criticalService key shipped in the client bundlesrc/lib/db.ts
criticalRow-level security disabled on 3 tablesusers · orders · messages
highPermission checks run in the browser onlysrc/routes/admin.tsx
highNo rate limit on public endpoints/api/generate
mediumStripe webhooks never handledpayments
Verdict: 71% of the code is worth keeping.1 fixed price, 48h
How a rescue works.
Fixed price, milestone payments, and a written audit before you commit to anything.
Audit, 48 hours
Send repo or tool access. You get a plain-language report of what is solid, what is dangerous, what is unfinished, and a fixed price for the rest.
Fix and harden
Security first: auth, data access, secrets, rate limits, payments. The invisible work that keeps your launch out of the news for the wrong reason.
Finish and launch
The stalled features get built, the deploy pipeline gets set up, and the app goes live on your domain with monitoring, alerts, and daily backups.
Stay if you want
Every rescue includes 30 days of fixes. Many founders keep us on afterwards for the roadmap, through Resident™, our monthly retainer.
The checklist
What your Claude Code app gets before we call it done.
Auth & permissions reviewRow-level security, written and testedSecrets moved out of the clientRate limiting on public endpointsInput validation everywhereStripe live mode + webhooksError tracking wired inUptime monitoring & alertsDaily database backupsCI/CD deploy pipelineCustom domain + SSLStaging environmentPerformance passPrivacy policy & terms pagesDocumented handover30 days of post-launch fixes
Claude Code questions
How do I audit an app Claude Code built for security holes?
That is the core of this rescue. We check every secret the agent touched (including anything committed to git history), verify database access rules table by table, confirm permission checks run on the API and not just the UI, and pressure-test auth and payment flows. You get a prioritised, plain-language report of what is exposed and a fixed price to close each item, in 48 hours.
Can you work directly in my repo alongside Claude Code?
Yes. Claude Code already lives in a normal git repository, which makes it one of the easiest tools to take over, there is nothing to export. We review the history, harden and finish the code, and hand it back structured so you can keep using Claude Code on top of something safe, with conventions the agent will follow.
Claude Code keeps breaking my build with big edits. What now?
That is the context-loss failure mode: a large multi-file turn, or a refactor in a new session, changes something an earlier decision depended on. We read the whole codebase with senior eyes, converge the drift into one structure, add tests around the critical paths, and make future agent edits safe rather than a gamble.
Send us your Claude Code project.
Book a 30-minute call with a founder. Within 48 hours of access you will know what is solid, what is dangerous, and what it costs to launch.
