Dravin AI · Blog · Market research

The 90 firms that fix AI-generated code

info@dravin.ai (Dravin AI) — Mon, 21 Sep 2026 18:30:00 GMT

TL;DR

We found 90 firms that fix apps built with AI tools. Over half name security as the problem; only two name duplicated logic.
Not one of the 90 names runaway AI API spend as something they fix.
The market has settled on one sequence: read the code, stabilise what is dangerous, refactor or rebuild what will not hold, then watch it.

In September 2026 we went looking for companies that sell cleanup of AI-generated code: apps built with Lovable, Bolt, Cursor, Replit, v0, Claude Code and similar tools, by people who then got stuck. We found 90. This post is what those 90 say they fix, how they package the work, and what we think a buyer should demand from any of them.

Why this category exists

In our reading of the 90 service descriptions, the typical caller in 2026 is a business owner, a product manager or a COO who built something real with an AI tool and then met real users, a payment that fails, or a security email from a stranger.

The demand is visible in public. On r/ExperiencedDevs, the thread “Getting more calls to fix ai generated codebases than actual new builds lately” reached 405 upvotes and 102 comments; one comment: “Cleanup contracts are gonna be a whole market segment.” On r/SaaS, an MVP dev shop said it lost half its pipeline to Claude Code in 2025; of the prospects who tried it instead, about a third shipped, a third broke in production, and three came back for cleanups. On r/vibecoding, a post pointing to a vibe-code fix service, asking builders about getting their “mess” fixed, drew 1,086 upvotes and 125 comments.

The failure rate is measurable. Veracode’s 2025 report found that AI-generated code introduced security flaws in 45% of its tests. How Bad Is It?, a public URL scanner for Lovable, Bolt and v0 apps, publishes a running counter: 4,271 apps reviewed, median score 38 out of 100.

45% of Veracode tests where AI-generated code introduced a security flaw. Source: Veracode, 2025
38 median score out of 100 across 4,271 Lovable, Bolt and v0 apps scanned. Source: How Bad Is It?

Who the 90 are

Type of firm	Count
Established dev agencies that added a cleanup service line	48
Human audit specialists	13
Agencies formed for rescue work	10
Automated scanners	10
Solo fixers and freelance studios	6
Marketplaces and expert networks	3

Twenty are in the USA, 18 in Europe outside the UK, 7 in India, 6 in the UK, 4 in Canada, 11 elsewhere, and 24 give no location. Size is mostly undisclosed (53 of 90); of the rest, 6 have 250 or more people, 10 are mid-sized and 21 are small, micro or one-person.

It is a young and thin market. We could open 75 of the 90 websites; 15 are known only from directory listings, and three domains (Vibe App Rescue, VibeCheckAudit, VibeFixLab) no longer resolve. Fifty-five name an AI builder in their service copy; Lovable leads (50), then Cursor (46), Bolt (44) and Replit (41).

What they say breaks

We counted which failure classes each firm’s service description names.

Failure class named in the service description	Entries (of 90, scanners included)
Security in general (vulnerabilities, OWASP, hardening)	48
Missing or broken tests	25
Performance and scalability	25
No deploy pipeline, CI/CD or hosting setup	23
Authentication and access control (including Supabase RLS)	18
Data model or database problems	15
Secrets and API keys in code	10
Monitoring and observability	9
Documentation	9
Payments and Stripe	8
Duplicated logic and coupling	2
Hallucinated APIs	1
Runaway AI API spend	0

Security is the sales pitch. Over half the market names it, and seven of the ten automated scanners are security scanners: Supabase row-level-security probes, leaked-key detection, public buckets. Beesoul, a US-listed audit shop (figures from its directory listing), reports that 10.3% of the Lovable apps it audited had critical RLS vulnerabilities, and that a typical MVP has 8 to 14 findings. Sidekick Interactive’s case study is typical of the genre: exposed API keys, database holes and broken payments in one app.

Structure is under-sold. Only two of the 90 entries, one of them a scanner, mention duplicated logic or unsafe coupling by name, though that is what makes an AI-generated codebase slow and risky to change. A security patch is usually local; untangling several copies of the same auth check, each slightly different, is where the work goes.

Nobody sells a spending cap. Not one of the 90 names uncontrolled AI API usage as something they fix; the two that mention “cost” at all mean something else. Yet on r/cursor, a thread about a Cursor bill that spiked within one hour, after a PM asked the agent to tag 87 tasks, reached 228 upvotes. An app that calls a model on every request with no budget, rate limit or per-user cap is a bill waiting to happen.

How they package it

The 80 human-service firms (the 90 minus the 10 scanners) use four patterns, often more than one at once.

Packaging pattern	Firms (of 80)
Audit, assessment or review named as the first step	61
Audit or assessment promised within 48 hours	10
Work described in sprints	9
Rebuild or re-architecture offered as one option	9
Explicitly against rebuilding	5
Retainer, maintenance or monitoring mentioned	16

Audit first. Valletta Software (Malta) is the cleanest version: a senior engineer reviews the repository across eight areas, delivers the audit in 48 hours with a debrief call, then scopes the cleanup, typically six to eight weeks. MetaCTO runs a 48-hour code audit, then promises production-ready in 30 days, with weekly demos.

Fixed-scope rescue. AxonBuild sells a 10-working-day production-engineering sprint covering auth, secrets, payments, CI/CD and monitoring, ending in a verified handover with two weeks of defect cover and 30 days of async support. Relux Works (Armenia) runs a one-week audit, then a two-to-three-week stabilisation sprint, then what it calls “de-vibe-coding”: moving the app to a production architecture.

Rebuild. Usually offered for the broken parts only, and five firms say outright that they avoid it. Bitnoise (Poznań) shows the whole sequence: audit in 3 to 7 business days, stabilisation sprint 2 to 4 weeks, re-architecture 6 to 12 weeks.

Retainer. Vibe-Audit (Barcelona, a one-person shop) runs a pre-launch security sweep delivered in 48 hours, done-for-you fixes, and then ongoing security monitoring.

Side by side, the market has settled on one sequence: read the code, stabilise what is dangerous, refactor or rebuild what will not hold, then watch it.

How cleanup is sold

Read the code: audit or review first
Stabilise: what is dangerous now
Refactor or rebuild: what will not hold
Watch it: retainer or monitoring

The sequence the 80 human-service firms describe, often combining more than one pattern.

What a good cleanup engagement includes

Use this on anyone you are considering, including us.

A written review before any commitment, with findings ranked by severity and a verdict: ship, patch, refactor or rewrite. If the verdict is “not worth fixing”, they should say so.
An experienced engineer who has actually read the code. A scanner finds leaked keys; it does not find the auth check that is bypassed on one route.
Security tested against the running app, not only the repository: authentication, per-row authorisation, secrets rotated rather than just deleted from git, public storage buckets closed.
Characterisation tests written before refactoring, so current behaviour is pinned and the cleanup cannot silently change it.
Duplicated logic collapsed and the data model reviewed, because that decides whether the next feature takes a day or a month.
A deploy pipeline and monitoring at the end: staging, CI, error tracking, backups. Working on one person’s laptop does not count as done.
AI API spend bounded: budgets, rate limits, per-user caps and an alert. Nobody in the 90 sells this; ask for it anyway.
Handover: documentation, and you holding the repository, the cloud accounts and the keys. You own the code from day one.
A fixed scope with a definition of done and a defect-cover window afterwards.

How we do it

Dravin AI is an AI software company. We build AI systems and software, and we clean up AI-built apps. Against the list above, this is what we commit to:

A written report first. Read-only access to one repository, and within 48 hours a written report with findings ranked by severity: the file, the risk and the fix, and what to leave alone. If nothing needs fixing, it says so. There is no obligation to go further.
Secrets. A secret we find in your repository is reported the same day, ahead of the report, and rotated within 24 hours.
Auth and data access. Every route’s auth check, database access policies included, is traced in the code. Testing the running app is agreed on the call, because it needs access beyond the repository.
Tests before refactoring. Tests on the paths that make money, run on every pull request, and structure changed in small, tested steps.
Deploys. From the repository, with a rollback that has been tried.
AI API spend. Timeouts, budgets and retry caps on every model call.
Ownership. The code is yours from the first commit, we work on branches, never main, and our access is removed within seven days of handover, confirmed in writing.
Defect cover. Anything that misses the statement of work, reported in writing within 30 days of handover, is corrected under it.

An engagement starts with a call about what you built, what it does in production and what worries you. If that is an app that got you to traction, book one or request a code review.

Method

Every count comes from the cleanup list in our research workbook: 90 firms, each with a segment, a region, a size band, a description of what it does, its delivery model and its stated turnaround. We read the list on 22 September 2026. The workbook itself is not published; these are the counting rules.

Type, region, size: counts of each firm’s segment, region and size band. “Small, micro or one-person” is Small (10 to 49) plus Micro (2 to 9) plus Solo.
Reachability: whether we could fetch the firm’s site or know it only from a directory listing, and whether its domain still resolves.
Tool mentions: a case-insensitive search of each firm’s description for each builder’s name.
Failure classes: a case-insensitive keyword search of the description only. Security: secur, vuln, OWASP, pentest. Tests: test, QA; Sherlock Forensics matches only through “pentest” and is excluded, so 25 rather than the mechanical 26. Performance: perf, scalab, bottleneck. Deploy: CI/CD, CI, deploy, pipeline, hosting, DevOps. Auth: auth, access control, RLS. Data model: data model, database, DB, schema, persistence, RLS. Secrets: secret, key(s), credential. Monitoring: monitor, observab, Sentry. Documentation: doc, docs, document or documentation as whole words. Payments: Stripe, payment. Duplication: duplic, coupling, dead code, untangle. Hallucination: hallucinat. AI spend: cost, spend, token, bill (the two hits, *instinctools’ “cost-benefit” and Vibe Code Rescue’s “perf & cost”, are not API spend). Scanner types: the descriptions of the 10 automated scanners.
Packaging: over the 80 firms that are not automated scanners, searching the description, the delivery model and the stated turnaround unless a rule says otherwise. Audit-first: audit, assess, review, scan, diagnos or scorecard. 48 hours: the turnaround promises an audit, assessment, scan or check result in 48 hours or less; fix times and reply times excluded. The ten: MetaCTO, Pfaff Digital, Sonder, VibeAudits, Mitrix Technology, Valletta Software, ShipClarity, Vibe-Audit, VibeCodeBlue and one solo fixer. Sprints: “sprint” anywhere in those three fields. Rebuild offered: rebuild, re-architect, rewrite or full build (11 firms), minus the two of them that also say “without rebuild”, “no rewrites”, “not rebuild”, “diagnosis-over-rebuild” or “without starting from scratch”. Against rebuilding: one of those five phrases in those three fields, the firm’s hero line or the workbook’s notes on how each firm positions itself (5 firms). Retainer: retainer, maintenance, ongoing, monitoring, subscription, defect cover or post-rescue support (16 firms).
Named offers, turnarounds and claims are quoted from what each firm publishes, unaudited.
Reddit and studies: r/ExperiencedDevs (405 upvotes, 102 comments), r/SaaS (65 upvotes, 66 comments) and r/cursor (228 upvotes) from our AI-agency landscape research (48 searches, 2,837 posts, 17 September 2026); r/vibecoding (1,086 upvotes, 125 comments, 24 December 2025) from a separate Reddit sweep for the workbook; Veracode’s 45% from the same landscape research.

This post first appeared on Dravin AI.

What 843 AI agencies actually sell

info@dravin.ai (Dravin AI) — Mon, 21 Sep 2026 18:30:00 GMT

TL;DR

Automation and custom builds account for 457 of the 843 firms we mapped. Only 31 sell audit, security or testing.
The thinnest part of the market is what a system needs once it is live: evaluation, monitoring and someone who answers when it breaks.
Size is unknown for 569 of the 843, so ask who will do the work, what happens after the build and how they will know it works.

Between 17 and 22 September 2026 we built a workbook of every AI agency, consultancy and AI-native delivery firm we could find: 843 firms across India, the US, Europe and a long tail of other regions. We wanted to see the market the way a buyer does. Every count below was computed from that workbook; the method is at the end.

The short version: most of the market sells the same two things, automation and custom builds, which together account for 457 of the 843 firms. Only 31 sell audit, security or testing. And the work a team needs once something is in production, evaluation, monitoring and someone on the hook when it breaks, is the thinnest part of the map.

What we counted and how

Eight research passes (Americas and ANZ, India, Europe and the Middle East, design-led studios, consulting and advisory, Asian, vertical and voice agencies, AI-code cleanup, freelancers), directory sweeps (Clutch, GoodFirms, DesignRush, Sortlist, and the n8n, Make and Zapier directories), and 211 firms carried over from our earlier landscape note. Duplicates were merged on domain. Of the 843 sites, 819 loaded and 619 homepages were read on the research date.

Each firm has a region, one of 35 segments, a size band and a description of what it does. Kept separately, outside the 843: 90 firms that fix AI-generated code, 103 independent consultants, and a 40-row catalogue of every offer type we saw, each rated by how many credible sellers it has.

One caveat: size is known for only 274 of the 843. Most firms do not say how big they are, which matters later.

The regional shape

Firms by region · 843 firms

India: 209
USA: 162
Europe (as tagged): 146
UK: 55
Australia and NZ: 41
Asia (other): 39
Middle East: 35
Latin America: 32
Canada: 28
Africa: 14
Global, multi-country, other or unknown: 82

All 843 firms by the region each is tagged with. Europe is the tag as found and holds some UK-based firms; the Method breaks down the last row.

The regions sell different things. India’s 209 are build shops: 46 dev studios, 27 boutiques, 21 mid-sized IT firms, 29 automation agencies. The US mix is flatter: 21 vertical agencies, 21 automation agencies, 19 dev studios, 11 forward-deployed engineering firms and all 9 big-consultancy AI arms. Europe holds the incumbents: 31 IT majors and consultancies, 15 nearshore firms, 14 data engineering firms. The UK leans to advice: 6 of the 14 governance firms and 5 of the 11 training firms are British.

What firms sell

The 35 segments group into nine offer families. The grouping is ours; every firm lands in exactly one.

Firms by offer family · 843 firms

Automation and agents as a service: 246
Custom build: 211
Embedded and enterprise delivery: 123
Advice and strategy: 117
Data engineering: 62
Audit, security and QA: 31
Platforms and tooling: 26
Training and community: 18
Other: 9

All 843 firms by offer family. Audit, security and QA, the rust bar, is 31 firms; automation and custom build together are 457. The table below lists the segments inside each family.

Offer family	Firms	Segments inside
Automation and agents as a service	246	142 SMB automation agencies, 70 vertical agencies, 26 voice-AI agencies, 4 productised services, 4 automation-and-coaching hybrids
Custom build	211	123 dev studios, 27 Indian boutiques, 26 design-led studios, 15 nearshore firms, 11 engineering firms with an AI practice, 9 AI-native delivery firms
Embedded and enterprise delivery	123	35 FDE firms, 31 IT majors based in Europe, 21 Indian mid-sized IT firms, 9 big-consultancy arms, 8 established Indian engineering firms, 7 platform-plus-services firms, 6 IT-major practices, 6 lab and hyperscaler arms
Advice and strategy	117	51 AI consultancies, 19 research and advisory, 17 strategy consultancies, 12 industry consultancies, 12 MSPs, 6 fractional-leadership firms
Data engineering	62	50 data and AI engineering firms, 12 analytics consultancies
Audit, security and QA	31	14 governance and compliance, 10 security and red-teaming, 7 QA and testing
Platforms and tooling	26	15 AI-native startups, 11 developer-productivity and AI-impact platforms
Training and community	18	11 training firms, 7 coaching communities
Other	9	Uncategorised

Automation-as-a-service and custom build account for 457 of the 843; audit, security and QA are 31. That ratio is the most useful fact in the workbook. Almost everyone will build the thing. Very few will tell you whether the thing is safe, correct or still working a month later.

What is crowded and what is thin

The catalogue rates each of the 40 offers by how many credible sellers we found: 22 crowded, 15 moderate, 3 thin.

Crowded:

Custom builds (agents, RAG systems, voice agents, internal tools, integrations) are the default offer of nearly every automation agency. The catalogue’s note is that capability is much the same everywhere; firms differ by vertical depth or proof.
Discovery and readiness audits take the least capital to start, so almost every new operator leads with one.
Staff augmentation is the default Indian services business, with hundreds of Indian shops selling the same thing.
AI support agents that resolve tickets are sold by nine platforms, bundled into the inbox the buyer already owns.
Data plumbing for AI (pipelines, warehouses, vector databases) is offered by every data consultancy and is the easiest thing on the list to buy.

Thin:

Evaluation harnesses, benchmarking and observability. Dozens of funded tool vendors, very few independents doing the implementation, because it takes real ML judgement.
Data-quality and AI-data-readiness audits. Crowded as software, thin as a service a person delivers.
Managed agents: monitoring, evals and a support SLA for AI systems already in production. Half a dozen vendors sell the dashboard; the human side, someone who answers when the agent breaks at 2am, is thin.

Codebase audit sits next to them, rated moderate: the automated side is crowded and well funded, and the human review is where the catalogue sees the gap. The cleanup list shows that gap starting to fill: 90 firms now sell cleanup of AI-generated code, 48 of them as a service line inside an existing dev agency and 13 as human audit specialists.

The firm counts say the same thing. 457 firms build. 31 audit, secure or test. 11 are platforms in the developer-productivity and AI-impact segment, measuring what AI is doing to engineering teams. Meanwhile the landscape’s Reddit sweep found an r/ExperiencedDevs thread titled “Getting more calls to fix ai generated codebases than actual new builds lately” at 405 upvotes.

What to check before hiring anyone

Ask who will be on the work. Size is unknown for 569 of the 843, and a website rarely tells you whether you are talking to a two-person studio or a firm of 7,000. Ask how experienced the engineers are, who checks their code before it merges, and whether any of it is subcontracted.
Ask what happens after the build. The market is crowded with builds and thin on evaluation, monitoring and support for systems already in production. Get a written answer on who maintains the thing, how a failure is detected and who answers when it breaks, before you sign for the thing.
Ask how they will know it works. An agent or a RAG system without an evaluation harness is a demo. Few firms sell evaluation as a service, so ask to see the test set, the metrics and the regression checks for the system you are buying, and ask what happens when a model version changes underneath it.
If you already have AI-generated code, get it read before you scale it. 457 firms will happily build on top of it; 31 sell audit, security or testing, plus the 90 cleanup firms outside the main list. A careful read finds the auth check missing on one route, the key committed to the repository and the same logic copied into several places. Each is easier to fix before the next feature lands on top of it.

What we do

Dravin AI is an AI software company. We build AI systems and software. Coding agents draft in parallel, each in its own isolated environment, automated checks run on every pull request, and an engineer approves each change before it merges. We also audit code and clean up AI-built apps.

What we build runs from agents, voice AI, fine-tuned models, classical ML and forecasting systems to web, mobile and desktop apps, and we deploy and run them in the cloud.

We also work in the thin part of this map: evaluation harnesses, and AI-generated codebases made safe enough for a real team to own. An engagement starts with a call. If any of the above describes where you are, book one and bring the repository.

Method

Every count comes from our research workbook, built between 17 and 22 September 2026 and counted on 22 September. The workbook itself is not published; these are the counting rules.

843: every firm on the main list; 211 of them came from our earlier landscape note.
Regions: the region each firm is tagged with, exact match. The 82 is Global 33, Other 24, Unknown 23, Multi-country or remote 2. Europe is the tag as found; it holds some UK-based firms.
Segments and families: each firm’s segment, exact match, filtered by region where one is named. The nine families are our grouping of the 35 segment values; the table is the mapping and it sums to 843. The 11 platforms are the segment “Dev-productivity / AI-impact platform”.
Size: each firm’s size band: Solo 17, Micro 60, Small 97, Mid 76, Large 24, Unknown 569; 274 known.
819 and 619: sites that passed a link check, and homepages read on the research date.
90, 48 and 13: the firms on the cleanup list; those whose segment is a dev agency with a cleanup service line; those whose segment is a human audit of AI-generated code.
103 consultants: the firms on the list of independent consultants and freelancers.
40 offers; 22, 15, 3: the offer catalogue’s 40 entries, each rated crowded, moderate or thin by how many credible sellers we found. The crowded and thin notes paraphrase the catalogue’s notes on custom builds, discovery and readiness audits, staff augmentation, support agents, data plumbing, evaluation, data-quality audits, managed agents and codebase audit.
The r/ExperiencedDevs thread (405 upvotes): from the Reddit sweep in our AI-agency landscape note.

This post first appeared on Dravin AI.