Skip to content
Author

Kato Chojiro

Takes AI-built MVPs to production: security, data, and the infrastructure underneath.

KC

Kato Chojiro

Full Stack Engineer

LinkedIn profileGitHub

Kato Chojiro is a full stack engineer and the person behind uBuilt. The work is narrow on purpose: apps built with Lovable, Replit, Base44, v0, Bolt.new, Bubble or Claude Code that already work, and the part the builder does not do - access control, data integrity, performance under real load, and infrastructure the founder actually owns.

Most of what shows up in an audit is the same handful of failures wearing different names: a service_role key in the browser bundle, row-level security that was never switched on, a synchronous call that falls over at a hundred users, a bill nobody can explain. The posts here are written from that work, with the actual setting or query that causes each one.

Every case study on the site is an anonymised composite. The engineering is real; the client details are not, on purpose.

Works in

  • Supabase and PostgreSQL
  • Row-level security and access control
  • Next.js and React
  • Cloud migration (AWS, DigitalOcean)
  • Production readiness for AI-built apps
Writing

Posts by Kato Chojiro

Security

Three days from launch to 4.75 million exposed records

Moltbook exposed 4.75 million records days after launch: one Supabase key in the bundle, no row-level security behind it. The check takes ten minutes.

September 22, 2026
Security

A cloned repository can run commands in your editor

Two patched Claude Code CVEs let a cloned repo run shell commands and redirect an API key. The bug is fixed; what it exposed about agent config is not.

September 22, 2026
Playbooks

The write failed and your user saw a success message

The most expensive AI-generated bug does not crash. It catches the error, returns a default, and reports success. Two greps find them in your repository.

September 22, 2026
Infrastructure

Your Firestore bill is reads, not users

Firestore charges per document returned, so one unbounded list view can cost thousands of reads a visit. How to find yours, and the one-line count fix.

September 22, 2026
Product

Millions of apps get built. Why so few become products.

Millions of AI-built apps, very few products. The gap is not code quality. It is four things between prototype and product that never show on screen.

August 26, 2026
Security

Eleven all-caps warnings did not stop it: what agent access to production should look like

A coding agent wiped a production database during a code freeze. The real lesson is about credentials, and it holds whether or not an agent is involved.

August 19, 2026
Infrastructure

What ten thousand users actually breaks, in the order it breaks

Ten thousand users is small for a database and large for an app nobody measured. The four bottlenecks in the order they arrive, and what each costs.

August 12, 2026
Engagements

What a $2,000 production hardening project actually buys you

What a $2,000 production hardening project buys: where the hours go, what is in scope at that price, and when $2,000 is the wrong number to be paying.

August 6, 2026
Migration

What moving off Replit actually costs, in money and in weeks

Moving off Replit costs real money and real weeks. Where the hosting crossover sits, what a migration runs, and the three cases for staying put.

July 22, 2026
Mobile

Rejected under guideline 4.2: what Apple means by “more than a repackaged website”

App Store guideline 4.2 rejection, explained by what the reviewer actually opens. The six additions that clear it, and the ones that reliably do not.

July 8, 2026
Security

The four holes we find in almost every Bolt.new app

Almost every Bolt.new app has the same four holes: a service key in the bundle, row-level security off, unescaped output, an unprotected login route.

June 17, 2026
Mobile

React Native or Flutter: two questions that settle it

React Native or Flutter turns on two questions: what your front end is written in, and who maintains the app in two years. The rest is a tie-break.

June 3, 2026
Migration

From builder hosting to your own cloud without downtime

Zero-downtime migration from builder hosting to your own cloud: inventory, parallel build, three shapes of data move, and a cutover you rehearse first.

May 21, 2026
Playbooks

v0 gives you a finished frontend. The backend is the actual project.

v0 gives you production React and no backend at all. How to derive a schema from the components you have, plus two server action security mistakes.

May 20, 2026
Product

The day your internal tool became load-bearing, and nobody noticed

Internal tools built with AI go load-bearing quietly. The four things that change once somebody's job depends on it, and the audit trail to add now.

May 6, 2026
Playbooks

Your AI-built app just got its first enterprise security questionnaire

Your first enterprise security questionnaire, decoded: what procurement is really asking, and the six controls that unblock most of a 180-row sheet.

April 15, 2026
Playbooks

A production readiness checklist for AI-built apps

The production readiness checklist we run before an AI-built app takes real users: secrets, authorization, data, backups, runtime, delivery and cost.

March 17, 2026
Infrastructure

AWS or DigitalOcean for your first real deployment

AWS or DigitalOcean for a first real deployment: the question is who operates it on a Tuesday. A framework, six services, and when it is neither.

March 4, 2026
Infrastructure

Why your Replit app falls over at 100 users

Development servers, ephemeral disks, sleeping instances and connection math. The four bottlenecks that show up together, in the order you should fix them.

January 27, 2026
Security

Your service-role key is in your JavaScript bundle

A Supabase service-role key in your JavaScript bundle is a database superuser in public. Find it in ninety seconds, then rotate in the right order.

December 9, 2025
Security

The Supabase row-level security mistakes in almost every AI-generated app

Supabase row-level security is the top critical finding in our audits. The five policy patterns that keep showing up, and the SQL that closes each one.

November 12, 2025

Ready to go live with confidence?

Let's turn your app into a reliable product your users love.

Book a Free Call