Vibe coding: you built an app with AI, what next?

An app built with Lovable, Cursor, Claude Code or ChatGPT is an excellent prototype, but before you let real users and data in, it needs a review of security, the data model, deployment and backups. The fastest route is a short audit by a senior developer, who will tell you what just needs fixing, what needs rewriting and what can stay as it is.

This article covers how to tell your prototype has hit its ceiling, what to check before launch, and when to fix versus start over.

What vibe coding is

Vibe coding is a way of building software where you do not program the app, you describe it. You tell the AI what you want, it writes the code, you try the result and describe the next change. For a founder who wants to validate an idea, that is a huge shift: a working demo instead of a slide deck, in days instead of months.

The catch is that AI optimises for things that look like they work. If you do not understand the code, you cannot see what is happening underneath, and the code grows without a plan.

Signs your prototype has hit its ceiling

• Every new request to the AI breaks something that used to work.
• The app only runs on your laptop or inside the tool's sandbox and you do not know how to get it onto your own domain.
• You want to let customers in but do not know whether one can see another's data.
• The app slows down with more users or more data.
• It needs payments, invoicing or a carrier integration and the AI keeps going in circles.
• Nobody but the AI knows how the code works, and you are afraid to change anything.

What to check before launch

Area	What to look at
Login and permissions	Does the server verify on every request who the user is and what they may access? Checks only in the browser are not enough.
Secrets	Are API keys or database passwords in the code, in git or in the frontend?
Data	Will the database structure still make sense in a year? Are there indexes and constraints, or does only the app hold things together?
Errors	What happens when a payment or an external API fails? Will you find out?
Deployment	Can the app be deployed repeatably, with separate test and production environments?
Backups and GDPR	Is the database backed up, can you restore it, and do you know where customers' personal data lives?

We cover the most common problems in detail in 7 things AI-generated code almost always gets wrong.

Where each kind of tool hits its limits

Not every prototype is the same. Where it was built determines where the problems will be:

• Tools that also host the app (such as Lovable): a fast start, but the database and login run on services you did not choose. Before launch, check the data access rules and whether the code can be exported and run elsewhere.
• AI editors and agents (such as Cursor or Claude Code): the code is on your machine and under your control, but deployment, servers and backups are entirely up to you.
• Code copied from a chat: usually no structure, no git and keys right in the files. This is where an audit pays off most.

What to prepare before an audit

• Access to the repository or an export of the code.
• A few sentences on what the app should do and who will use it.
• A list of what does not work or what worries you.
• What data it will hold, especially personal data or payments.
• The date you want to launch.

The more precise the materials, the fewer hours the audit takes.

Fix or rewrite?

A developer's first reaction is often "we'll rewrite all of this". Often that is not necessary. If the chosen technology is reasonable and the data model can be saved, it pays to fix security, tidy the structure and gradually replace the weakest parts. Your work on the prototype is not wasted and the app launches sooner.

A rewrite pays off when the problem is in the foundations: data stored in a way that cannot be queried sensibly, all the logic in the browser, or a tool the app cannot be exported from and run elsewhere. Even then the prototype serves as a precise specification, so new code written with AI assistants comes together quickly.

How to get it into production

1. Audit. A senior goes through the code, data and deployment and sends a list of problems ranked by risk.
2. Estimate. You get an hour estimate for each part and decide what must be done before launch and what can wait.
3. Fixes. Security and data first, then stability and performance. AI assistants do the routine work, a senior reviews every change.
4. Deployment. Your own server or cloud, domain, HTTPS, backups and monitoring.
5. Further development. You can keep vibe coding, just with rules and with someone who reviews changes before they go live.

That is exactly how our AI code to production service works. If you want a second opinion first, a one-hour consultation is enough. Deployment and operations are covered by hosting and DevOps.

How to vibe code more safely today

• Keep the code in git and commit after every working step. When the AI breaks something, you can go back.
• Never put real passwords or keys into a prompt or the code. They belong in environment variables.
• Test on made-up data, not on real customers.
• Ask the AI not only "do it" but also "what can go wrong" and "who has access to this".
• Before your first real user, have the code reviewed by someone who understands it.

Have an AI-built app and not sure how to move on? Send us a link or repository access and a senior will tell you what needs doing before launch and roughly how many hours it will take.