From vibe-coded MVP to production: the rescue checklist

AI app builders and coding agents have made it possible for a founder to ship a working product in a weekend. That's genuinely great. What happens next is less fun: the first real users arrive, and so do the first real problems.

The numbers back this up. In a 2026 survey of non-developers who built apps with AI tools, 83.8% hit issues they couldn't solve alone, and only 31.5% had the code professionally reviewed. Among professional engineers, an Adaptavist survey found 55% reported increased technical debt from AI-generated code and a third reported new operational risk.

This is the checklist we run when founders bring us a vibe-coded MVP through our maintenance service.

Day 1: stop the bleeding (security)

Secrets

• Search the repo and the built client bundle for API keys. AI tools often put service keys in frontend code
• Rotate anything that was ever committed, even if it's been deleted since. Git history remembers
• Move secrets to environment variables, with separate values for dev, preview and production

Database access

If you're on Supabase or Firebase, this is the most common critical issue we see:

• Row-level security must be enabled on every table that's reachable from the client
• Policies should check ownership (user_id = auth.uid()) or tenancy, not just "authenticated"
• Test it: sign in as user A and try to read user B's rows through the public API

Our Postgres row-level security guide shows the patterns.

Authorisation on the server

Hiding a button isn't access control. Every write and every sensitive read needs a server-side check: in an API route, a server action, an edge function or a database policy.

Abuse protection

• Rate limit sign-up, login, password reset and any endpoint that calls a paid AI API
• Put spend caps on your LLM provider account. A leaked key plus no cap is how a £20 MVP becomes a £4,000 bill

Days 2–3: make failures visible

• Add error tracking (Sentry or similar) on frontend and backend
• Add uptime checks on the golden path: sign up, the core action, payment
• Turn on database backups and test a restore
• Log the important business events, not just errors

Days 4–6: protect the core path with tests

You don't need 80% coverage. You need confidence that the three things users pay for still work after every change.

1. Write end-to-end tests (for example with Playwright) for the golden path
2. Add unit tests around money, permissions and data transformations
3. Run them in CI on every pull request, and block merges on failure

This is also what makes AI-assisted development safe from here on. See our AI code review workflow.

Week 2: pay down the structural debt

AI-generated code has recognisable patterns:

Smell	Why it hurts	Fix
The same logic copy-pasted in five components	Bugs get fixed in one place only	Extract shared modules
1,500-line page files	Nobody (human or AI) can reason about them	Split by responsibility
Inconsistent data fetching	Race conditions, stale UI	One data layer and one pattern
Unused dependencies and dead code	Bundle size, attack surface	Prune with a dependency audit
No types at the boundaries	Runtime crashes on bad data	Schema validation (for example Zod) on inputs and API responses

Tackle the modules you touch most often first. Debt in code nobody changes can wait.

Week 2+: set up a real delivery pipeline

• Preview deployments for every pull request
• Lint, typecheck and tests in CI
• Database migrations in version control, not clicks in a dashboard
• A staging environment that mirrors production config

When a rewrite is actually justified

Rewrite only if:

• The data model is fundamentally wrong (for example, no concept of organisations in a B2B tool)
• The chosen platform can't meet a hard requirement such as compliance, offline mode or scale
• Fixing costs more than rebuilding the core path. This is rare in our experience

Even then, migrate incrementally behind the existing UI. Don't stop shipping for three months.

Bottom line

Vibe coding got you to product–market signal fast. Now spend a sprint making it secure, observable and testable, and you can keep the speed without the 2 a.m. incidents.

Want a second pair of eyes? We run fixed-scope rescue sprints for AI-built MVPs: security audit, fixes and a CI pipeline, usually within two weeks. If you're raising money or being acquired, pair this with our technical due diligence checklist. Book a review.