Vibe Code Rescue — Make Your AI-Built App Production-Ready

What actually goes wrong in AI-generated apps?

Three things, in order of danger: secrets that reach the browser, authentication without authorization, and no verification layer at all. AI builders optimize for a screen that works, not for the person attacking it. The code is correct on the happy path and undefended everywhere else.

The findings repeat with unnerving consistency. Provider keys and service-role credentials exported through client-visible environment variables. Row-level security switched off, or policies permissive enough to deny nothing. Payment webhooks accepted without signature verification. Secrets still live in git history long after someone believed they were rotated. Then the quieter half: no schema validation at the API boundary, ownership checks nobody wrote, N+1 queries missing every index they need, strict mode disabled, build errors ignored in config, and zero tests.

How do you make a Lovable or Replit app production-ready?

Security first, correctness second, structure third. I read the whole codebase, rank every finding P0 to P3, and fix the ship-stoppers before touching architecture. Validation and authorization come next, then TypeScript strict mode, a test suite, and a CI gate so the next change cannot silently undo the work.

Order matters more than the individual fixes — refactoring a codebase that still leaks credentials only produces cleaner leaks. The first pass is read-only, and you get the ranked findings before any code changes, so you decide what is in scope. Hardening then goes boundary by boundary: Zod schemas on every payload, ownership and role checks on every read and write, and rate limits on anything expensive — especially model calls, where an unthrottled route is a direct line to your billing account.

Can the app be saved, or does it need a rewrite?

Almost always saved. Generated apps are structurally naive rather than fundamentally wrong — one enormous file, copy-pasted data access, no boundaries. That refactors incrementally behind tests. A rewrite is only honest advice when the data model itself is broken and real users already depend on it.

The rewrite instinct is usually a reaction to how the code reads, not to what it does. Ugly is cheap to fix. Genuinely expensive is a schema that cannot represent your business — one users table doing the work of three entities, money stored as floats, no audit trail on anything that changes state. Those decisions propagate into every query and migration. You get a straight recommendation either way, with reasoning, before you commit budget.

Is there a completed rescue, or is this just capability?

There is a completed one. An AI invoicing SaaS originally built on Replit went through exactly this pass and shipped: a security audit first, then files past a thousand lines broken into modules, strict TypeScript with Zod validation at the boundaries, rate limiting, CSRF protection, and a Jest and Playwright suite underneath it. That engagement is finished and paid.

The mapping onto the services listed above is close to one-to-one, which is the point of showing it. Security audit first, because refactoring a codebase that still leaks credentials only produces cleaner leaks. Then input validation and data integrity — Zod schemas at the API boundary and strict TypeScript switched back on. Then refactor and modularization, taking the generated thousand-line files apart into modules with boundaries. Then the abuse surface a generator never considers: rate limiting on expensive routes and CSRF protection on cookie-authenticated ones. Then the test suite and CI gate, Jest for units and Playwright for the flows that matter, so the next change cannot silently undo the work.

What that receipt does not cover is every platform in the tagline. It was Replit. Lovable, Bolt, v0, and Cursor generate the same class of defect and the same pass applies, but I will not describe a Replit rescue as a Lovable one. The standard the hardening is held to is documented separately: on the Reg CF backend, balances are never stored — they derive from an immutable stream of 31 event types, escrow movement is locked behind a six-state machine, and 248 tests gate every change across 28 models and 30 documented endpoints. PSI Nest carries the security half: AES-256 at rest, TLS 1.3 in transit, field-level PHI encryption, role-based access across four roles, and a six-year immutable audit log.

This site is another artifact you can inspect. Every deploy passes TypeScript strict, ESLint at zero errors, machine-checked meta, schema, internal links and banned claims, plus Playwright smoke tests — with a live Lighthouse of 94 performance and 100 across accessibility, best practices, and SEO. A rescued app gets the same harness.