Why vibe-coded apps break in production
AI app builders are genuinely impressive. In a weekend you can go from an idea to a working product with auth, a database and payments. That speed comes from a trade-off, though: the tools optimise for “does it work in the preview?”, not “is it safe and reliable when strangers use it?”
Problems show up in predictable places:
- Secrets in the browser. API keys for OpenAI, Stripe or email providers end up in frontend code, where anyone can copy them and run up your bill.
- Open databases. Supabase and Firebase rely on row-level security rules. AI-generated projects often ship with rules that are too loose, or missing entirely, so any logged-in user can read or edit anyone’s data.
- Security on the frontend only. An “admin” page hidden behind an
ifstatement in React isn’t protected. The API behind it usually answers anyone who asks. - Fragile data handling. Inputs aren’t validated, errors are swallowed, and a single unexpected value takes down a page.
- Performance cliffs. Queries that were fine with ten test rows time out with ten thousand real ones.
- No deployment discipline. Test and production share a database, there are no backups, and there’s no way to roll back a bad prompt.
None of this means the tool was a mistake. It means the app has reached the point where it needs an engineer’s eye.
How the rescue works
I treat your codebase the way a security reviewer and a senior engineer would: find what can hurt you first, then fix what slows you down.
- Triage within 48 hours. If keys are leaked or data is open, those get fixed before anything else, usually the same day.
- Auth and data access. I check every route and table: who can read, who can write, and whether that’s enforced on the server.
- Reliability. I add input validation, proper error handling, logging and alerts, so you hear about problems before your users tweet about them.
- Performance. I profile the slowest pages and queries, add indexes, remove N+1 queries and cache what should be cached.
- Deployment. Separate environments, managed secrets, automated deploys, backups and a rollback path.
You stay in control throughout. Every fix is a small, readable commit, and the final walkthrough explains what changed and why.
After the rescue: keep building fast
The goal isn’t to stop you using AI tools. It’s to make it safe to keep using them. I’ll leave you with:
- a repository structure the AI tools can work within
- basic automated checks that catch regressions
- a short “rules for prompting” guide specific to your codebase
If you’d rather hand ongoing development to an engineer, I offer monthly retainers too. Many rescues turn into exactly that: you keep the product vision, I keep the system healthy.
Is your app ready for investors or enterprise customers?
Due diligence and security questionnaires will ask about authentication, data isolation, backups, incident response and dependency management. A rescue audit gives you honest answers to those questions, and a report you can share. It’s far cheaper to find these problems yourself than to have a prospect’s security team find them for you.