You built it fast. Now find out if it is ready to take real money.

I’m Jonathan Jaime, a senior software engineer. I audit products built with AI coding tools and give you one answer, backed by evidence: is this system ready for the step you’re about to take? That might be charging customers, launching, or onboarding your first big client.

Fixed price, $5,000 to $9,000. About a week. I do all the work myself.

Book a free 20-minute scoping call See how I decide

It works in the demo. Charging for it is a different test.

AI tools write code that runs, and running is the easy part to check. These questions decide whether you can charge for it:

Can one customer see another customer’s data?
Does a payment count once, or can it count twice?
What happens when a webhook arrives late, or twice, or not at all?
Where do the API keys live, and who can read them?
When something breaks at night, what tells you?

Most founders I talk to can’t answer these yet. That’s normal early on. It stops being normal the day real money goes through the system.

This is for you if

You built with Claude Code, Codex, Cursor, Lovable or Replit, and you’re about to launch or charge.
A buyer or client is about to run a technical review, and you don’t know what it will find.
You want a straight answer before the milestone, not after the incident.

What this is not

It isn’t a penetration test.
It isn’t a compliance audit, and it issues no certification.
It doesn’t promise your system is secure. Nobody can honestly sell you that.

The audit: one milestone, one verdict.

You pick the step you’re about to take. I test your system against that step, as it stands in one frozen commit, and come back with a verdict and the evidence behind it.

Also available: production hardening after an audit, engineering advisory for founders, and codebase review for agencies building for clients.

1Scoping call. Twenty minutes. We agree on the milestone, the exact commit, the environment and the flows that matter. We also write down what is out of scope.
2The work. I work out what must always be true in your system and test each point both ways: it works when it should and refuses when it shouldn’t.
3The verdict. You get the report, the evidence log and a call with me to go through both. No sales deck follows.

How I decide if a system is ready: PRISM

PRISM is the method I run on your repository. It doesn’t scan and it doesn’t score. It answers one question:

Is this system, in this frozen commit and this environment, ready for this specific milestone, given the assumptions we wrote down together?

1
Scope. We fix the milestone, the exact commit, the environment, the critical flows and the exclusions in writing, before I touch the code.
2
Invariants. From that scope I write down what must always be true, in plain sentences. For example:
“a tenant only reads its own invoices.”
3
Tests, both ways. Each invariant gets a positive control, which checks that it works when it should, and a negative control, which checks that it refuses when it shouldn’t. One direction alone proves little.
4
Evidence. Every result is recorded with an ID, the commit, the command that was run, the result and a hash. A summary written by a language model never counts as evidence.
5
Verdict. I give one of four verdicts, listed below.

READY
CONDITIONALLY READY
NOT READY
INSUFFICIENT EVIDENCE

Maturity scores, 1 to 5, are recorded per area. They are never averaged into the verdict.
Missing evidence never becomes an approval. If I couldn’t test something, the verdict says so.
I decide the severity of each finding and the final verdict. A model never certifies its own work.
PRISM makes no compliance, certification or absolute-security claims.

What you get

The verdict, on the first page, in one line.
The findings, ordered by severity, each one tied to the evidence that proves it.
The evidence log: IDs, commit, commands, results, hashes.
What to fix before the milestone, separated from what can wait.
A call with me to go through it, with time for your questions.

About

I’m Jonathan Jaime, a senior software engineer, and Mati Systems is my practice. When you hire me for this audit, no team works behind the scenes and no junior gets your repo. I read the code, run the tests, write the verdict and join the call.

I also build Mati, an open-source guardrail system for AI coding agents, and I use these tools every week. I know where agent-built code tends to cut corners because I have watched it happen.

$5,000 to $9,000. Fixed, before we start.

The price depends on the scope we set on the scoping call: the milestone, the size of the codebase and the flows involved. Once we agree on scope, the price is fixed. I don’t bill hourly, and there’s no surprise invoice at the end. The audit takes about a week.

Book a free 20-minute scoping call

Questions

Is this a penetration test?

No. A pentest attacks your system from outside. This audit reads your code and tests from inside whether the things that must hold do hold.

Will this certify us for compliance?

No. PRISM issues no certification and makes no compliance claim. You get a verdict with evidence, which often helps before a buyer’s technical review, but it is not a compliance stamp.

Who does the work?

I do, and nothing gets handed off to anyone else.

Does it matter which tool I built with?

No. Whether you used Claude Code, Codex, Cursor, Lovable or Replit, the tool changes the habits of the code, not the questions I ask about it.

What do you need from me?

Access to the repository, the milestone in your own words, and one call to fix scope. If evidence for something is missing, I’ll say so. I won’t fill the gap with a guess.

What if the verdict is NOT READY?

Then you learned it in a week, in private, with the fixes listed in order, instead of hearing it from a customer. That is the cheapest time to find out.