Pooja Kumari
Founder · Sales and client relationships
Pooja manages Aatvi and leads sales and client relationships, from understanding the initial problem to coordinating the engagement.
From AI prototypes to legacy systems, software needs sound engineering.
Aatvi helps teams rescue AI-built software, modernize legacy systems, and deliver dependable applications.
Rescue, build and modernize.
Start with the work your application needs. Bring an AI-built prototype, an existing product or a legacy system that needs a careful path forward.
AI Code Rescue
Review AI-generated code, investigate unreliable behavior and plan the fixes. Begin with a scoped audit; agree implementation as a separate engagement.
Explore the audit and remediation process
AI Software Development Services
Build and extend applications, integrations and AI features with tests, deployment and handover in scope.
Software Modernization
Decouple monolithic cores, establish operational data layers, and modernize legacy enterprise systems through phased migrations designed to minimize operational disruption.
Understand the system. Then decide what to change.
- Repository & flows
Agree the scope
Start with your application, the problem and the constraints. Agree access, deliverables, price and schedule before work begins.
- Diagnostic review
Review and prioritize
Trace the agreed flows, investigate the risks and document the evidence. Review the findings together.
- Remediation plan
Take the next useful step
Use the plan with your own team or scope an implementation with us. Agree acceptance checks and handover for that work.
Diagnostic inspection session — illustrative finding
Diagnostic ReportDiagnostic sweep summary
Target: app/api/** (route handlers across auth, billing, webhooks)
Auditing tenant isolation, webhook idempotency, connection pooling, and schema validation...
CRITICAL: Cross-tenant data access via service_role bypass in invoices route
-> Route parameter trusted without workspace membership validation
HIGH: Stripe webhook handler lacks transactional idempotency gate
HIGH: Direct Postgres driver exhausts connection pool under serverless concurrency
MEDIUM: Request payloads cast with TypeScript as instead of runtime validation
4 launch blockers analyzed · Prioritized remediation plan compiledAction required: Remediation before production deployment
Illustrative findings from our published synthetic SaaS code teardown.
Start with evidence you can inspect.
Read the review checklist, explore an illustrative report and compare rescue with a rewrite. These guides explain our approach; they are not customer case studies.
Explore AI Code RescueTenant Isolation & AST Inspection PipelineSystem Topology
Technical teardowns & architecture guides
Code Remediation
From prototype shortcut to hardened production.
AI coding assistants frequently skip authorization checks and race-condition safety. We audit, test, and repair the code so your team can ship with confidence.
app/api/workspaces/[id]/invoices/route.ts
Code Remediation
Before · Vulnerable AI PrototypeService-role client · RLS bypass risk
1 // app/api/workspaces/[id]/invoices/route.ts2 export async function GET(req: NextRequest, { params }: RouteContext) {3 const { id: workspaceId } = await params;4 5removed: - // FLAW: Service-role key bypasses RLS and trusts route param6removed: - const supabase = createClient(process.env.SUPABASE_URL!, process.env.SUPABASE_SERVICE_ROLE_KEY!);7removed: - const { data: invoices } = await supabase.from("invoices").select("*")8removed: - .eq("workspace_id", workspaceId);9 return NextResponse.json({ invoices });10 }After · Aatvi Production RescueMembership verified · Scoped query
1 // app/api/workspaces/[id]/invoices/route.ts2 export async function GET(req: NextRequest, { params }: RouteContext) {3 const { id: workspaceId } = await params;4added: + const supabase = createServerClient(req);5added: + const { data: { user } } = await supabase.auth.getUser();6added: + if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });7added: + // HARDENED: Verify membership in workspace before query8added: + const { data: member } = await supabase.from("workspace_members")9added: + .select("role").eq("workspace_id", workspaceId).eq("user_id", user.id).single();10added: + if (!member) return NextResponse.json({ error: "Not Found" }, { status: 404 });11added: + const { data: invoices } = await supabase.from("invoices").select("id, amount, status")12added: + .eq("workspace_id", workspaceId);13 return NextResponse.json({ invoices });14 }Illustrative synthetic finding from our published SaaS code teardown report.
Internal engineering project
Aatvi ERP: exploring connected operations
Aatvi ERP is one of our internal projects. It explores how finance, people and operational workflows can share useful context.
Cascade is the design concept behind it: trace how one business event could affect several departments, with people reviewing the next steps.
Know who leads the work.
Aatvi is a new company. Our engineers bring experience from software projects for multinational companies, including legacy enterprise modernization.
Niraj
Technical lead · Engineering
Niraj leads engineering at Aatvi, bringing over 16 years of software engineering experience, including legacy enterprise modernization for multinational companies.
What does your software need next?
Tell us what you have, what is getting in the way and what needs to change. We will discuss a useful first scope with you.