I'm Bryce Watson. I build, fix and harden software for solo founders and teams of every size, at whatever stage you're in.

A written list of what could hurt you, what to fix first and a fixed price for each fix.

1. Every finding ranked Critical, High, Medium or Low: where it is, what I saw, why it matters in plain words and how to fix it.

   • Critical
   • High
   • Medium
   • Low
2. A short answer at the top: can you put real users on this now, only after the must-fix items, or not yet? If I couldn't check something, the report says what and why.
3. A 30-minute call to walk through it, included. You can share the report with investors or a new hire, and they're welcome on the call.

$400 for now; the price is locked when you book. If you hire me for the fixes within 14 days of the report, the $400 comes off their price.

What $400 covers: one app with one database, the kind a single builder project creates. If yours is bigger, I'll tell you the price before you pay anything. Built in a no-code tool without a code export, like Bubble? Tell me first and I'll say whether I can review it. The 2 business days start when I have the code and a test login.

What I'll ask you for: the code (read access to your GitHub repository, or an export from your builder) and a test login, ideally one ordinary user and one admin. Read-only access to your database and hosting settings helps but isn't required. If your database holds real customer or patient records, we set up a test copy instead, so I never see them. I'll send step-by-step instructions, and I never need live keys.

Already live? The report marks anything you should switch off or work around now, while the fixes happen.

See a sample report → An anonymised review of a public open-source Lovable app.

I read your code and settings and test with accounts you set up for me. I don't attack your live app or touch real user data unless you've agreed in writing first.

1. B.1SecurityCovered

   Secret keys in the code or sent to visitors' browsers. Database rules (in Supabase, row-level security) that let one user read or change another's data. Server code that trusts whatever the browser sends. Libraries with known security holes.

2. B.2Sign-in and accountsCovered

   Sign-up, login, password reset and logout, and whether a user can reach records or admin tools that aren't theirs.

3. B.3Data and privacyCovered

   What personal data the app collects, where it's stored, who can read it, which outside services get it, and whether you can delete it or restore from a backup.

4. B.4ReliabilityCovered

   What happens when a payment, email or AI service fails or runs slowly, whether you'll see the errors, and whether orders can be lost or charged twice.

5. B.5DeploymentCovered

   How a change reaches your live app, where keys are kept, how fast you can undo a bad release, and whether you could run the app without your builder.

6. B.6Cost risksCovered

   Paid services any visitor can trigger with no cap, and plans that will bill you unexpectedly as you grow.

7. B.7Code healthCovered

   How hard the code will be to change safely, and what's most likely to break next.

How deep each area goes depends on the access you give me, and the report says plainly what I couldn't check. It's a code and configuration review, not a penetration test, legal advice, a compliance certificate or a promise that the app has no bugs.

Every piece of work gets a fixed price before I start, not an hourly meter.

• Each item comes with a plain test of what "fixed" or "done" means, for example "when user B asks for user A's orders, they get an error". You approve the tests first.
• If you built it with Lovable, Replit or Bolt, you keep building there afterwards: I make changes so they sync back, usually through its GitHub connection. If your builder can't take outside changes cleanly, I'll say so in the quote, before you pay.
• You get a handover note: what was done, what's still open and what to watch.
• Anything new gets its own short quote. I won't quietly grow the job or the bill.

Small builds, $200: a script, a spreadsheet automation, a browser extension or a connection between two tools you already use.

My builder already runs a security scan. Why pay you?

Run it; it'll catch some things. A scanner gives you a list. I add judgment on what matters for your app and your launch, confirm every finding myself and give you a fixed price to fix each one. In the sample report, the finding that looks scariest to a scanner mattered least, and the real risk was a database rule that depended on one dashboard setting.

My app handles health or other personal data. Can you work on it?

Yes. I work from test data, never real patient or customer records, and we'll agree how your data is handled before I start. I don't provide compliance certification. If you need me to sign a business associate agreement or another data agreement, send it first: I'll read it and tell you whether I can work under it.

I run a studio or agency. Can you review client work?

Yes. I can deliver the report unbranded and without my fix quote, so you price the fixes. I never contact your clients, and we can arrange pricing for repeat work.

What happens to my code?

I keep it confidential and I'll sign your NDA. I use AI coding tools (Claude Code and OpenAI Codex) with training on your code switched off. Your production database and your users' records never go into them, and I delete my copies of your code and data when we're done. Please send test keys, not live ones.