Emergency triage for AI apps broken in production — one bug in 48 hours

48 hour bug fix schedule, hour by hour

The clock starts when you pay. Intake inside two business hours, reproduction before any patch, and a written report before handoff. No unrelated refactors — the discipline is how we keep the promise.

Before and after a typical 48 hour bug fix

Real triage pattern: a Lovable-generated Supabase client that exposes the service-role key to the browser and queries orders with no auth check. The after-patch moves the client server-side, uses the anon key, and lets RLS enforce user_id = auth.uid() instead of trusting a userId argument. Three-line root cause, ten-line patch, one regression test — that is the triage shape.

01// AI-shipped Supabase client — runs on the server AND the browser02// RLS disabled on this table; anon key used for everything03import { createClient } from "@supabase/supabase-js";04 05export const supabase = createClient(06  process.env.NEXT_PUBLIC_SUPABASE_URL!,07  process.env.NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY!, // leaked to browser08);09 10export async function getOrders(userId: string) {11  // no RLS, no auth check — any user can pass any userId12  const { data } = await supabase.from("orders").select("*").eq("user_id", userId);13  return data;14}

01// app/lib/supabase/server.ts — server-only client with RLS + user context02import { createServerClient } from "@supabase/ssr";03import { cookies } from "next/headers";04 05export async function supabaseServer() {06  const cookieStore = await cookies();07  return createServerClient(08    process.env.NEXT_PUBLIC_SUPABASE_URL!,09    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!, // anon key, RLS on10    { cookies: { getAll: () => cookieStore.getAll() } },11  );12}13 14export async function getOrders() {15  const supabase = await supabaseServer();16  // RLS enforces user_id = auth.uid(); no userId argument, no spoofing17  const { data } = await supabase.from("orders").select("*");18  return data;19}

Eight deliverables every emergency triage ships

• 01One reproducible bug identified, traced to root cause, and fixed
• 02Clean git diff reviewed before merge — no unrelated refactors
• 03Written root-cause report — what broke, why, and one prevention recommendation
• 04Reproduction steps documented so the founder can verify the fix independently
• 05Regression test added for the failing path (included, not upsold)
• 06Priority intake — starts within one business day, delivered inside 48 hours
• 07One round of follow-up questions answered at no extra charge
• 08Full refund if we miss the 48-hour deadline on agreed scope

One bug, one price, one 48 hour bug fix clock

Emergency triage vs Upwork vs in-house rescue

A $299 fixed fee against a $1,500 Upwork bid or a day of in-house engineering lost to a single production fire.

Debugging engineers who run the 48 hour bug fix

Triage is usually the right specialist plus the right two-hour trace. Pick the expert whose failure mode matches your bug.