Skip to content
Angelo LamonacaBook a call

Available for new projects

You vibe-coded the prototype. I'll make it production‑ready.

I'm Angelo, a senior full-stack engineer in Switzerland. I take apps built with Lovable, Bolt, v0, Replit, Cursor or Claude Code and make them secure, reliable and ready for paying users, usually without starting over.

Fixed prices, and you keep all the code. You talk to me, the engineer doing the work, not a sales team.

launch-report · yourapp.com

  • Database rules

    3 tables readable without logging in

    Critical
  • API keys

    OpenAI key shipped to the browser

    Critical
  • Payments

    Stripe webhooks not verified

    High
  • Backups

    None

    High
  • Errors

    You hear about them from users

    Medium
  • Deploys

    Straight to production

    Medium

Not safe to launch yet

38/100

An example. Your audit lists every issue it finds, with the fix.

Works with apps built in

  • Lovable
  • Bolt
  • v0
  • Replit
  • Cursor
  • Claude Code
  • Windsurf
building production software
6 years
installs of my own AI app
10K+
on payment code at HolidayCheck
2.5 years
running a client platform in production
14 months

Sound familiar?

The demo works. That was the easy part.

AI tools are brilliant at what you can see. What breaks when real users and real money arrive is everything you can't: who can read the data, where the keys are, what happens when a payment fails.

  • Every fix breaks something else

    The AI goes in circles. You prompt, it repairs one screen and quietly breaks two others, and you're no longer sure what the code does.

  • Anyone might be reading your data

    If your database rules (like Supabase RLS) are missing or too loose, the public key inside your app is all it takes to read or change every row.

  • Your secret keys are in the browser

    Keys for OpenAI, Stripe or your database end up in frontend code, where anyone can copy them and run up your bill.

  • Payments work, in test mode

    Real money brings webhooks, failed cards, refunds, cancellations and tax. One missed case means a customer who paid and got nothing.

  • You'd hear about outages from users

    No error monitoring, no backups, no way to undo a bad deploy. The first sign of trouble is an angry email.

  • Someone's about to look under the hood

    A first developer hire, a big customer's security review, an investor's due diligence. Right now the code wouldn't survive it.

170 of 1,645

apps built with Lovable that a security researcher checked in 2025 let anyone read or change their database, using nothing but the app's public key.

Source: CVE-2025-48757

45%

of coding tasks in Veracode's 2025 test of more than 100 AI models produced code with a known security flaw. The models got better at writing code, not at securing it.

Source: Veracode, 2025 GenAI Code Security Report

It isn't the tools' fault. AI builds what you ask for, and nobody asks for row-level security. That's the part I do.

Check your own app with the free 25-point checklist

The standard

What “production‑ready” actually means

This is the checklist I work through on every app. The audit tells you where you stand on each line. The sprint turns every line green.

Security

  • Login and roles checked on the server, not just hidden in the UI
  • Database rules that stop people reading rows that aren't theirs
  • Secret keys out of the browser; rate limits on anything that costs money
  • Input validation, security headers and a dependency audit

Payments

  • Checkout and subscriptions set up properly
  • Webhooks verified, and safe to receive twice
  • Failed payments, refunds, cancellations and plan changes
  • Invoices and tax the way your market expects

Reliability

  • Error monitoring with alerts
  • Daily backups, and a restore that has actually been tested
  • Database migrations instead of manual edits
  • Staging, preview deployments and one-click rollback

Code you can build on

  • Your repo, your accounts, a structure that makes sense
  • Tests on sign-up, payment and your core flow
  • A pipeline that blocks broken changes
  • Docs a new developer, or an AI agent, can follow

Privacy and compliance

  • Privacy policy and terms that match what the app really does
  • GDPR and Swiss data protection basics: consent, export, deletion
  • Data stored where your customers expect it to be
  • AI features disclosed the way the EU AI Act asks

AI features

  • Per-user limits, so one account can't burn your API budget
  • Protection against prompt injection and abuse
  • Queues and caching for slow or expensive model calls
  • Costs you can see per user and per feature

How it works

From “it works on my screen” to launched, in four steps

Small, visible steps and no surprises. You always know what I'm working on, what it costs and when it ships.

  1. 130 minutes

    Free call

    You show me the app and where you want to take it. I tell you honestly what it needs, and whether I'm the right person for it.

  2. 25 working days

    Audit

    I go through the code, the database, the hosting and the payments. You get a written report with every issue ranked by risk, and a fixed quote.

  3. 32–3 weeks

    Sprint

    I fix it in your repo, in small steps you can follow: a preview link for every change and a short update twice a week.

  4. 4On your date

    Launch and handover

    Deployed to your accounts and documented, with a walkthrough video. Then 30 days of free bug fixes, and a care plan if you want one.

Start with the free call

Already know what you need? Skip the audit and go straight to a sprint.

Proof

I've built and run what you're about to launch

A client platform run in production, payment code on a big consumer product, and my own app with real users, real subscriptions and app store reviews.

GenVistaMy own product · live since 2024

An AI app with real users and real subscriptions, on the web, iPhone and Android.

GenVista makes AI pictures, video and music in the browser, and GenVista Pictures does it on iPhone, iPad and Android. I design, build and run all of it: accounts, subscriptions on the web and in both app stores, GPU inference that keeps costs in check, and the releases that keep it all working. It's the road your MVP is about to take, from prototype to paying users.

installs on Google Play
10K+
from 405 App Store ratings
4.0★
  • Next.js
  • TypeScript
  • Supabase
  • Stripe
  • React Native
  • Python
  • AWS

genvista.greenApp StoreGoogle Play

The home screen of GenVista Pictures on iPhone: a box to describe a picture, and tools for realistic and cartoon images.

EcoflowsClient · 14 months

A production platform for recycled materials on large construction sites.

For DMU-Consult in Munich I built the Ecoflows platform end to end and ran it in production for fourteen months: the web app in Next.js and TypeScript, backend services and integrations in Node.js, Java and Python, and the API and architecture around them. We met at The Pool, a one-week prototype contest hosted at Google Munich.

  • Next.js
  • React
  • TypeScript
  • Node.js
  • Java
  • Python

dmu.de

HolidayCheckEmployee · 2.5 years

Payments on a travel platform people book their holidays through.

In HolidayCheck's Premium team I worked on the paid side of the product: vouchers, discounts, benefit eligibility and subscription payments, in React and Node.js on Google Cloud. Payment code either reconciles or it doesn't. I've written enough of it to be careful with yours.

  • React
  • Node.js
  • TypeScript
  • Google Cloud

Also

  • Needless UI

    An open-source UI component library for Angular: native elements first, accessible colours checked against WCAG 2.2 AA, and 800+ tests run in three browsers.

    needlessui.com

  • Napoland

    An online exploration game for phones, played in the browser. The code, maps and roadmap are open source.

    napoland.com

  • Inselspital Bern

    3D medical imaging (DICOM) in the browser, with React and Three.js, for a university hospital's neuroinformatics team.

  • Small business sites

    Sites with online booking and reservations for a restaurant in Berlin and a therapist in Zürich, in three languages.

    osteria-uno.eu

References

What people who've worked with me say

Quoted exactly as they wrote it on LinkedIn, with their names attached so you can check.

I worked with Angelo Lamonaca on GenVista and can confidently say he's one of the most solid engineers I’ve collaborated with. He’s sharp, fast, and gets things done without overengineering which is exactly what you need when building something from scratch. Angelo has that rare ability to switch between backend, infrastructure, and product thinking effortlessly. He's just genuinely easy to work with. No ego, always available, and focused on moving the team forward.
Justin Polidori

Staff DevSecOps Engineer, ABOUT YOU

Was Angelo's mentor · worked together on GenVista

Angelo is a very experienced developer. He is very passionate about his job. He answers very promptly to challenging situations. Very pleased to work with him.
Benedetto Biondi

CEO, Folks Finance · Techstars mentor

Worked with Angelo on the same team

Angelo is very passionate about his job and can handle an entire platform on his own. He's a fast learner and a very reliable colleague.
Luca Meneghini

Senior Full Stack Software Engineer

Worked with Angelo on the same team

Angelo is a very smart developer who regularly comes up with clever solutions for his tasks. He always wants to improve and is eager to learn the newest technology. In addition to that, he has a great sense for modern UX design which is reflected by his frontend work.
Henrik Prüß

Software Engineer, Nabogo

Colleague at Adference

Pricing

Fixed prices. No hourly surprises.

You know the full price before any work starts, and it only changes if you change the scope.

  • Launch Audit

    Find out exactly what's wrong before you spend more.

    €900CHF 900$990

    Fixed price · 5 working days

    • Review of your code, database rules, login, API keys, payments and hosting
    • Written report: every issue ranked by risk, with the fix
    • Fix it or rebuild it: an honest recommendation
    • A fixed quote, if you want me to do the work
    • 45-minute call to walk you through it

    Credited in full if you book a sprint within 30 days.

  • Most popular

    Launch Sprint

    Your prototype, fixed, hardened and live.

    from€4,900CHF 4,900$5,400

    Exact price fixed by the audit · 2–3 weeks

    • Everything in the audit
    • Every critical and high-risk issue fixed
    • Login, roles and database rules done properly
    • Payments that reconcile: checkout, webhooks, subscriptions
    • Error monitoring, backups and a staging environment
    • Tests on the flows that make you money, run on every change
    • Handover docs and a walkthrough video
    • 30 days of free bug fixes after launch
  • MVP Build

    When the prototype is the spec, not the foundation.

    from€12,000CHF 12,000$13,500

    Exact price fixed after scoping · 4–8 weeks

    • Scoping session: what version one needs, and what it doesn't
    • Built on a stack any developer can pick up: TypeScript, Next.js, Postgres
    • Accounts, payments, emails, admin panel and analytics
    • Web app, plus iOS and Android if you need them
    • Security and privacy built in from day one
    • Launch, handover and 30 days of free bug fixes

Care plan

After launch: uptime and error monitoring, security and dependency updates, backups checked, and up to 4 hours of fixes or small changes every month. Cancel any time.

from €490CHF 490$540 / month

Prices for businesses, excluding VAT where it applies. Invoiced by a registered Swiss business in EUR, CHF or USD. Sprints and builds: 50% to start, 50% on delivery.

Angelo Lamonaca, smiling, at a meeting table.

About

Hi, I'm Angelo.

I've been building production software since 2020: payment code at HolidayCheck, 3D medical imaging for a neuroinformatics team at Inselspital Bern, and a fourteen-month platform build for a construction-recycling company in Munich.

Since 2023 I've also run my own studio, Neuramare, where I build GenVista and a handful of other products. So I know the founder's side of the table: the launch date that won't move, the budget that has to stretch, the feature you're scared to touch in case it breaks.

I use AI coding tools every day. I'm not here to tell you vibe coding was a mistake: it got you a working demo faster than any agency could have. My job is everything that comes after the demo.

  • Based in Baar (Zug), Switzerland. Remote, on Central European Time.
  • Works in English, German and Italian.
  • Registered and VAT-registered Swiss business.

LinkedIn GitHub

FAQ

Questions founders ask first

Something else on your mind? Email me and ask.

Do I have to throw away what I built?

Usually not. Most AI-built prototypes have a solid core: the screens, the flows, the idea. I keep what works and fix what's dangerous. When a rebuild really is cheaper, the audit shows you why, with numbers, and your prototype becomes the spec.

Which tools and stacks do you work with?

Code from Lovable, Bolt, v0, Replit, Cursor, Claude Code, Windsurf and similar tools: React, Next.js, Vite, TypeScript and Node.js, with Supabase, Firebase or Postgres behind it, Stripe for payments, and Vercel, Netlify, AWS or Google Cloud for hosting. For mobile apps, React Native with Expo. If your app needs something else, I'll tell you on the call whether I'm the right person.

Can I keep building with AI after you're done?

Yes, and you should. I leave the project set up for it: tests on the important flows, a pipeline that stops a broken change before it reaches users, preview deployments, and rules files that tell Cursor, Claude Code or Lovable how your app is built. You keep your speed without silently breaking login or payments.

Do you fix Supabase row-level security (RLS)?

Yes. It's the most common hole in AI-built apps. I go through every table, storage bucket and edge function, write policies that match who should see what, and test them as each kind of user, including someone who isn't logged in. A policy that exists but lets everyone through is still a hole, and a dashboard check won't tell you.

Can you fix my Lovable app's SEO?

Yes. Lovable apps render in the browser, so link previews, most AI crawlers and sometimes Google see little more than an empty page. I move the public pages to server rendering with Next.js, or prerender them, and add titles, descriptions, share images, a sitemap and structured data. The app behind the login stays as it is.

What happens on the free call?

Thirty minutes on video. You show me the app and tell me about your users, your launch date and your budget. I tell you the biggest risks I can see and roughly what fixing them costs. No slides, no sales pitch, and if I'm not the right fit, I'll say so.

Who owns the code?

You do, from the first commit. Everything lives in your GitHub and runs in your own accounts: Vercel, Supabase, Stripe and so on. No lock-in, no agency retainer, nothing you'd need my permission for later.

What if the work takes longer than planned?

The price is fixed for the agreed scope, so that's my risk, not yours. If you want to add something mid-project, I quote it separately before doing it, and you decide.

How does payment work?

The audit is paid upfront. Sprints and builds are 50% at the start and 50% on delivery. I invoice as a registered Swiss business, in EUR, CHF or USD.

How do you handle access to my app and data?

Through accounts you create for me and can revoke at any time, with the least access the job needs. I'm happy to sign your NDA first. I don't copy your users' data to my machine, and when the project ends, my access ends.

Where are you based, and when can you start?

In Baar, near Zurich, Switzerland, on Central European Time. I work remotely with founders in Europe and North America; my afternoons overlap with US mornings. I take on a few projects at a time, so I'll give you a real start date on the call.

Why not hire an agency, or the cheapest freelancer I can find?

You can. With me you get one senior engineer who has built and runs his own product, does the work himself and publishes his prices. No account managers, no juniors learning on your app, no estimate that doubles halfway through.

Show me what you built.

Book a free 30-minute call and bring your app link or repo. You'll leave knowing what it needs to be production-ready, what that costs and how long it takes. If I'm not the right person for it, I'll tell you.

Prefer writing? angelo.lamonaca@pm.me. I reply within one working day.