AI MVP rescue — field notes

If you've ever: inherited code you didn't write · fixed a login nobody understood · moved a site at midnight · told a client "this isn't safe yet" without making them feel stupid — you have most of this job.

An AI MVP (minimum viable product) rescue developer takes an app a founder built with AI tools (Lovable, v0, Bolt, Cursor), finds what blocks launch — usually security, data and deployment — fixes it, and hands over something the founder can run.

"It worked yesterday." "Users can see each other's data." "Payments go through but nothing records." "I don't know how to put it live." Triage first, then fix the launch-blockers.

Debuggers. People who read code calmly. Ex-agency developers. Less suited: freshers without debugging experience — consider AI chatbot builder first.

Root: reading unfamiliar code → Branch: JavaScript/TypeScript reading · Git · Branch: Supabase auth & row-level security · Postgres basics · Branch: deploy on Vercel/Netlify · env vars & secrets · Leaf: writing a triage report.

• Lovable free: 5 build credits/day, up to 30/month.
• v0, Cursor, Vercel Hobby: free plans exist.
• Supabase free: 500 MB DB, 2 active projects, pauses after 1 week of inactivity; Pro is paid.
• Bolt.new: popular; current plan limits not confirmed — check before advising.
• Certifications: none needed.

• 0–10 min: founder explains what the app should do and who uses it. You just listen and note.
• 10–25 min: screen-share. Sign up as a new user, try the main flow, try to see another user's data, check where secrets live.
• 25–40 min: look at the repo and hosting: is it in Git? are environment variables set? is there a backup?
• 40–50 min: sort findings into launch-blocker, fix soon, nice to have.
• 50–60 min: agree what you'll send: a one-page report with a fixed-price fix list. No promises about timelines you haven't scoped.

Check these first on almost every AI-built app:

1. API (application programming interface) keys or service-role keys exposed in front-end code.
2. Database access rules (Supabase row-level security) missing or too open.
3. No way to reset a password or delete an account.
4. Payments recorded only on the client side.
5. No error tracking — Sentry's free Developer plan is enough to start.
6. Free database tier that pauses when idle (Supabase free does after a week).
7. No backups or no Git history.
8. No basic tests for sign-up and checkout — Playwright is free and open source.

Founders are often proud and worried at once. Lead with what works. Explain each risk in one plain sentence ("Right now any signed-in user could read every order"). Give the fix and an effort size. Never mock the tool they used — it got them this far.

Skill Receipt

Tick the skills you have from a list of 14 (e.g. "read someone else's code", "rotated a leaked key", "calmed a client during downtime"). Out prints a shop-style receipt — monospace, line by line — with a blank beside each: "proven by: ______". No money values, just proof prompts. Print it and fill the blanks as you finish quests.

We haven't verified pay data for this role. Job listings for "full stack developer jobs" (5,400 searches/month India, 2,900 US) are a useful place to see live ranges.

Founder communities (Indie Hackers), startup job boards (Wellfound, Cutshort, Instahyre), past clients who now "built something with AI". Demand is mostly global and referral-led ("ai mvp development": 480/month US, 50 India).

WordPress developer · Web developer · PHP developer

1 generate an app in Lovable or v0 · 2 export to GitHub · 3 Supabase auth + row-level security tutorial · 4 list 10 issues · 5 fix the worst 2 · 6 deploy on Vercel Hobby · 7 write a one-page report. Then 30/60/90: audited demo + report (60 XP) → 3 free founder triage calls (40 XP) → 1 paid rescue + before/after report (60 XP). Small versions; pause allowed.

Freelance is quickest to start. Jobs: "product engineer" or "full-stack (Next.js/Supabase)". Your audit reports are your portfolio either way.

"Full-stack developer · I rescue AI-built MVPs: security, data, deploys."

Scope creep ("while you're in there…") — use a written scope. Some code is unrecoverable; say so early. You may touch user data — handle it carefully; not legal advice.

Web, PHP, WordPress and full-stack developers come here. Founders built apps with Lovable, Bolt, Cursor or v0 and now have broken auth, leaky keys and no deploys. Your starting artefact is a production bug you fixed before — the 'rescue' habit is the skill.

Assumes 2–3 hours a day alongside job applications, a laptop and a phone, and free plans only. Every step has a smaller version and a way to pause. Use them. It runs in three blocks of 30 days, each ending with a signal that you're on track. A signal is not a promise of a job or income.

Worries people bring to this route

• Founders want young devs? They want someone who can find the security hole in an hour. Years of production bugs are the pitch.
• A gap on my CV. Rescue a public AI-built demo and write a before/after note with dates.
• No degree. Founders read your fix list, not your certificate.
• English on client calls. Send the triage board in writing first; calls then just confirm it.
• Family wants stability, not freelance. Rescue work often converts to part-time retainers or a full-time offer from the startup.
• Tight money. Charge for a fixed-scope audit first; it's small, quick and paid upfront.

What AI changed in your old tasks

Your first 7 days

Days 1–30: A rescue case study

Signal by day 30: A founder replies asking about their app.

Days 31–60: A real codebase

Signal by day 60: A paid fix or a contract interview.

Days 61–90: Productised

Signal by day 90: Repeat work or second interview.

Where the openings are, and what to type

Also worth a weekly look: Instahyre, Cutshort, Wellfound, and iimjobs or hirist for senior roles. Upwork and Contra if you want freelance work.

Founders who built with AI tools and got stuck. They post on Upwork, Contra and X, and in founder WhatsApp groups. Agencies hire on LinkedIn as 'full-stack developer – AI apps'.

• LinkedIn search string: ("full stack" OR "MVP") AND ("AI-generated" OR Lovable OR Bolt OR Cursor OR "vibe coded")
• Naukri / foundit keywords: MVP developer, full stack developer startup, bug fixing Next.js Supabase

Job-hunt moves that matter for this route

• Look on Upwork, Contra and X for 'fix my Lovable/Bolt app', 'Supabase help'.
• Founders pay for clarity: a plain-language report wins trust.
• Never take production credentials over chat; use their dashboard invites.

Unpaid "test projects" that are real work; paid access to "founder leads". Never share OTPs or UPI PINs. Report: cybercrime.gov.in / 1930; ReportFraud.ftc.gov.

React expert required? Reading level to start. Fixed price or hourly? Triage as fixed price; fixes as a scoped sprint. Will AI tools make rescue unnecessary? Possibly less of some fixes over time; judgement about safety and trade-offs stays human for now — our view.

Quiz · Related: solutions engineer · API integration engineer