Frequently asked questions

Rivyva helps you take an app built with an AI tool to production. We check your code and live site for the problems that commonly break apps once real people use them, fix what we can with small pull requests, have an engineer review every fix, and prove the result with drills.

No. Every finding explains why it matters in plain English, and every fix comes with a short summary. You'll need to be able to merge a pull request on GitHub, and we'll show you how.

Apps made with Lovable, Bolt, Cursor, Replit and v0, and most JavaScript or TypeScript web apps on GitHub. Our checks focus on common stacks such as Next.js, Vite and React, Supabase, Firebase and Stripe. If your stack is different, run free Vitals or ask us.

A read-only check of your public site: HTTPS and certificates, protective headers, keys exposed in your site's code, public database access and files that shouldn't be public. You get a Health Score and the top findings. It doesn't look at your code repository.

A full scan of your repo and live site; fix pull requests for every critical (P0) problem and up to 5 serious (P1) problems; engineer review of every fix; a restore drill and a webhook drill; a before-and-after Proof Report; a readiness letter; 30 days of Watch; and our 30-day re-fix guarantee. Founding price $750.

If a fix we opened, a Rivyva engineer reviewed and you merged stops passing its check within 30 days, we fix it again at no cost.

Yes, in these cases. Full refund if we haven't started your scan within 48 hours of payment. If the scan finds no critical or serious (P0 or P1) problems, you choose a 50% refund or credit toward Watch. A refund if we don't deliver the items in your plan within 14 days. We don't refund for fixes you chose not to merge. A person on our team approves each refund.

Request an Audit by email. We'll reply within 2 business days with next steps. We don't take online payments yet.

No. You install our GitHub App on the repositories you choose. For optional deeper checks, you can give us a time-limited, read-only token that you can revoke at any time.

No. The GitHub App can create branches whose names start with rescue/ and open pull requests. It can't merge, push to your main branch, change settings or edit your workflows. We never deploy to your live app.

Close the pull request. Nothing changes in your app. The finding stays on your list, and you can mark it as an accepted risk with a reason.

Every pull request includes the exact steps to undo it, usually a single revert. Every fix has a test and is reviewed before we mark it ready, but you should still check it in a preview or staging environment before merging. If a merged fix stops passing its check within 30 days, the re-fix guarantee applies.

No. We scan it inside a temporary environment that's deleted afterwards. We keep only short, redacted snippets around each finding so you can see what we found.

We use AI to explain findings and draft fixes, only after you agree to it. Secrets are removed from what we send.

Email hello@rivyva.com to delete your account. We finish within 30 days and send you a confirmation. Removing the GitHub App also schedules deletion of that app's data.

No, and no honest test can promise that. The letter lists exactly which checks passed on which version of your code, which didn't, and what we didn't check. It's a record of evidence, not a guarantee against every possible problem.

It's a number from 0 to 100 based on the problems found, weighted by how much harm they could do. Any open critical problem keeps the score below 50. Checks that couldn't run are shown as Not checked and don't count either way.

P0 is critical: data or money could be exposed now. P1 is serious: exploitable with some effort, or likely to cause an outage or data loss when something fails. P2 is worth fixing: good practice that lowers risk.

Yes, on request. We test the move on a staging copy first and give you a checklist. You switch your domain when you're ready; we never switch it for you.

Yes. Contact us about working on your clients' apps; each app owner must install the GitHub App and agree to our terms.