How to make a vibe-coded app production ready (and what it costs to fix)
A vibe-coded app is usually 80% of a product. It signs people up, shows the screens and runs the happy path well enough to demo. The missing 20% is the part nobody prompted for: authorization, secrets, failed payments, error handling, tests and monitoring. That is what breaks with real users, and fixing it costs $1,000 to $3,500 over 1 to 2 weeks with a team that builds with AI every day. A traditional agency quotes about 3 times that and takes 3 times as long, because it rewrites by hand what a directed AI pipeline can regenerate under review.
We build every project with AI, so this is not a post about AI writing bad code. It is about what happens when nobody reads it.
Why vibe-coded apps break in production
Lovable, Bolt, Cursor, Replit and Claude Code all do the same thing when used without engineering: they build exactly what was described. The failures cluster in the same five places:
- Authorization. Login works, but the rules about who may see which row are missing or wrong. In 2025 the Lovable row-level-security bug (CVE-2025-48757) let generated apps expose other users' data because the policies were never written. Escape.tech later found 2,038 critical vulnerabilities across 1,400 apps built on vibe-coding platforms.
- Secrets in the frontend. API keys for OpenAI, Stripe or a mail provider end up in client code because that was the fastest way to make the feature work.
- Payments without unhappy paths. The checkout works. Declines, refunds, double submits, webhooks arriving twice and a subscription that fails on renewal were never prompted for.
- Duplicated logic. The model solves the same problem five times in five slightly different ways instead of writing one function. GitClear measured an eightfold rise in duplicated blocks since 2022, and every copy drifts.
- No tests, no monitoring. The first sign of a bug is a customer message.
The numbers behind this are not small. Veracode tested more than 100 models and found 45% of AI-generated code samples introduce an OWASP Top 10 vulnerability. Georgia Tech's Vibe Security Radar counted 35 CVEs in March 2026 alone that trace directly to AI coding tools.
Vibe coding vs agentic engineering: the difference is who directs the AI
Andrej Karpathy coined "vibe coding" in early 2025 and a year later said the era was ending, replaced by what he called agentic engineering. The tools did not change. The discipline around them did.
Agentic engineering is four habits vibe coding skips:
- Plan. A written spec before code: the data model, who can do what, what happens when a payment fails. GitHub's Spec Kit passed 111,000 stars this year because teams found that an agent working from a spec succeeds first time far more often than one working from a chat.
- Direct. A senior engineer decides the architecture, the boundaries and the parts the AI is not allowed to improvise.
- Review. Every generated change is read by someone who can tell a wrong answer from a plausible one.
- Verify. Tests and checks the agent has to pass, because an agent will report success on code that does not run. The single best thing we did for the speed of our own AI pipeline was to stop taking its word for it.
The METR randomized study is the caution here: experienced developers using AI tools were 19% slower on real tasks while believing they were 20% faster. Speed without review is a feeling. Speed with review is how we deliver 3 times faster.
Production-readiness checklist for an AI-built app
If your app passes these, it can take real users. If it fails more than two, it needs a production pass before it takes real money:
- Every database table has authorization rules, and a test proves user A cannot read user B's rows.
- No API key, token or password exists in frontend code or the git history.
- Payments handle declines, refunds, retries and duplicate webhooks, and a failed renewal downgrades the account instead of crashing it.
- Input is validated on the server, not only in the form.
- Errors are caught, logged and reported somewhere a human looks.
- The core flow has automated tests that run before every deploy.
- The database has backups and you have restored one at least once.
- Someone on your side can read the code well enough to change it without the tool that generated it.
Point 8 is the one founders skip. An app you cannot leave the platform with is a subscription, not an asset.
Rescue or rebuild?
Rescue when the app has real users, the core flow works and the data model is roughly right. The 80% the AI built is worth keeping, and a production pass is cheaper than a rewrite every time.
Rebuild when one of three things is true: the app cannot be exported from its platform in a form you can run yourself, the data model is wrong for the product it has become (a single-user tool that now needs teams and roles), or the code has no structure left to fix. A three-day audit answers this with evidence rather than opinion, and it is the cheapest three days in the whole project.
What it costs to make a vibe-coded app production ready
These are our numbers. They are low because the same fixes take fewer hours when AI regenerates the code and senior engineers direct and review it, not because the pass is lighter. Traditional agencies typically charge 3 times as much and take 3 times as long, because they rewrite by hand.
| Scope | Price | Timeline | What it includes |
|---|---|---|---|
| Audit | $400-800 | 2-3 days | Security and code review, the checklist above with evidence, a rescue-or-rebuild recommendation, a prioritised fix list |
| Production pass | $1,000-3,500 | 1-2 weeks | Authorization, secrets, payment unhappy paths, validation, error reporting, tests on the core flow, backups, monitoring, a clean deploy pipeline |
| Migration off the platform | $4,000-8,000 | 2-4 weeks | Moving the app to a stack you own, keeping the working 80%, restructuring the rest, the full production pass on top |
The market rate for the same production pass at rescue-only shops runs $7,500 to $15,000. The gap is the pipeline, not the scope.
How we do it at DForce
We do not write code by hand and we do not let AI ship unreviewed. Every project starts with a spec, an AI pipeline generates the code against it, and senior engineers direct the architecture, review every change and own the parts that are expensive to get wrong: the data model, authorization, payments and anything that touches production data. Verification is automated, because we learned early that an agent's "done" means nothing until a test agrees.
That is the same discipline a rescued app needs, so we apply it in the same order: audit first, then the fixes in priority, then the tests that keep it fixed. You get a codebase your next engineer can read and a written account of what changed and why.
Frequently asked questions
What is a vibe-coded app? A vibe-coded app is software built by describing what you want to an AI tool such as Lovable, Bolt, Cursor, Replit or Claude Code and accepting the code without reading it. The term comes from Andrej Karpathy in early 2025. It is a fast way to get a working demo and a slow way to get a product, because the parts nobody prompted for, such as authorization, failed payments and error handling, are the parts that break with real users.
Why do vibe-coded apps break in production? Because the AI built exactly what was described and nothing else. The typical failures are missing authorization rules that let one user read another's data, API keys shipped in the frontend, payment flows with no handling for declines and refunds, duplicated logic that drifts apart, and no tests or monitoring, so the first sign of a bug is a customer. Veracode found that 45% of AI-generated code samples contain an OWASP Top 10 vulnerability.
How much does it cost to fix a vibe-coded app? With an AI-first team, a security and code audit costs $400 to $800 and takes 2 to 3 days. A full production pass that fixes authorization, secrets, payments, error handling, tests and monitoring runs $1,000 to $3,500 over 1 to 2 weeks. Moving the app off a no-code platform onto your own stack costs $4,000 to $8,000 over 2 to 4 weeks. Traditional agencies quote about 3 times these numbers because they rewrite by hand what an AI pipeline can regenerate under review.
Should I fix my vibe-coded app or rebuild it from scratch? Fix it if the app has real users, a core flow that works and a data model that is roughly right. Most of what the AI built is worth keeping. Rebuild when the app cannot leave its platform, the data model is wrong for the product it has become, or the code has no structure to fix. A three-day audit answers the question with evidence before you commit to either.
If you have an AI-built app that works in the demo and worries you in production, book a discovery call and we will run the checklist on it and tell you, with evidence, whether it needs two weeks or a rebuild.
What we do about this
Let's talk about your product and growth goals.
Keep reading
How much does it cost to build a SaaS product in 2026?
SaaS development cost is not the cost of an app plus a Stripe button. Subscription billing, workspaces and roles, onboarding and the monthly bill after launch all move the number. Here is what each part costs, what the first version should contain, and how AI-first teams build the same product 3 times cheaper.
How much does it cost to build a marketplace in 2026?
A marketplace is not a bigger online store: it has two sides, commissions and payouts, and a trust problem. Here is what each part costs, what the first version should contain, and why most marketplaces fail on supply rather than software.