You shipped an app on Lovable, Bolt, v0, Cursor or Replit. Now a customer wants to pay you, an investor wants to invest, or a partner wants to integrate. All three ask the same question: is this thing actually safe to run in production. This is the answer.

Full engineering audit against the v1 Ship Ready Standard (published, auditable, updated quarterly)

P1 remediation applied: exposed secrets rotated, Supabase RLS hardened, rate limits added, CORS locked down, auth boundaries fixed

Signed certification PDF valid for 90 days from the sign-off date

Verification badge you can drop on your site or pitch deck (links back to your public assessment)

30-day post-remediation warranty: if a P1 issue we signed off on turns up, we re-fix free

45-minute readout call walking your team (or your AI builder) through what changed and why

The sign-off is an independent engineering assessment against the v1 Ship Ready Standard as of the audit date. It does not warrant future security, and I'm honest about that up front. What it does is give you, your customers, and your investors a receipt from a human engineer saying: today, this app clears a defined bar. That receipt is worth something in every enterprise procurement conversation, every insurance renewal, every partner integration review.

Not a pen test. I have a separate £497 Pen Test service for diagnosis-only. If findings from the pen test warrant it, the £497 credits forward toward this Sign-Off.

Not a warranty of future security. Nobody offers that honestly.

Not a full rewrite. If the audit finds structural problems that need a rebuild, I'll say so and route you to a builder.

If the app fails the Ship Ready Standard on a P1 issue I missed within 30 days of sign-off, I re-audit and re-fix free. Full stop.

I'm Jasper Rexford. I build production AI agents for founders. I also audit and sign off on the vibe-coded apps founders ship without me. I run the v1 Ship Ready Standard publicly at rexford.dev so you can see exactly what you're paying for.