Take your vibe-coded app to production.
A vibe-coded app is ready for production when strangers can use it without breaking it, leaking data or needing you in the loop. That takes real authentication, access rules on the data, secrets kept off the browser, tests on the core workflow, a deploy you can roll back, and monitoring. Cosmic does this as a five-day sprint for a fixed $10,000, and you keep the code and every account.
Built in Lovable, Replit, Bolt, v0 or Cursor? Tell us what you have.
Functional is the easy part
Pivotal Labs teams judged software on a simple pyramid: Functional, Useful, Usable, Joyful. The best products reach all four. AI builders have made the bottom layer quick to build. The three above it still take product work.
Case in point: Saad Ahmed, Cosmic’s founder, built a partner sales room and CRM app called Tandem over nights and weekends. 35,000 lines of TypeScript. 90 React components. 22 database models. 84 API endpoints. It worked in 20 days.
“Though I could quickly fill in the Functional part of the triangle and vibe-code a bunch of features within three weeks, it still took two more weeks just to get load times under five seconds, address 28 security vulnerabilities, add rate limiting, deal with CSRF, and eliminate header injection in file downloads.”
What production-ready means for an AI-built app
The checks the sprint runs on day 1. Each one is a way vibe-coded apps commonly fail once strangers use them.
| Check | What breaks without it | How the sprint verifies it |
|---|---|---|
| Authentication and sessions | Accounts can be taken over, or pages meant for signed-in users are open to anyone. | Sign-up, password reset, session expiry and admin routes are tested with real accounts. |
| Access rules on the data | One user can read or change another user's records. | Every table's access policy is checked (for example, row-level security in Supabase) and tested with two separate accounts. |
| Secrets | API keys shipped to the browser get used by strangers, on your bill. | The built app is searched for keys; secrets move server-side and get rotated. |
| Data model | Duplicate or orphaned records pile up as usage grows. | The schema is reviewed and gets the constraints and migrations it's missing. |
| Tests on the core workflow | Every change risks breaking the one thing the app exists to do. | Tests cover the core workflow and run before every deploy. |
| Deploys and rollback | A bad release takes the app down with no quick way back. | A repeatable deploy to your own accounts, with a rollback path. |
| Monitoring and backups | You hear about outages from users, and lost data stays lost. | Error tracking, uptime checks and backups that have been restored once to prove they work. |
| Ownership | The app, database or domain lives in someone else's account. | Code, cloud, domain and database end up in accounts you own. |
What usually breaks first
Here’s what broke on Tandem after the functional version was done. Those are one app’s numbers, and yours will differ. The checklist above is how the sprint looks for each of them in your app.
Slow starts
Cold starts took 120 seconds, partly because the Neon Postgres database suspended after 5 minutes idle. Load times came down to under 5 seconds.
Chatty data access
Seven sequential database queries on every request. Saad calls these the silent app killers.
Security gaps
28 security vulnerabilities, including CSRF and header injection in file downloads.
No limits
Nothing stopped a user or a bot from hammering the API until rate limiting went in.
The same bugs, again
An "Anti-Patterns" doc for Claude Code so it stops repeating itself: 21 entries so far, each a production bug the agent introduced and then had to fix.
Fix it or rebuild it?
Fix it
The data model mostly fits the product, the core workflow works for real users, and the problems are configuration, coverage and hardening. This is the common case.
Rebuild part of it
One area is wrong at the root (often auth or the data model) while the rest holds up. Replace that area behind the same screens.
Rebuild it
Nobody can explain how it works, the data model fights every new feature, and fixes keep breaking other things. Keep the prototype as the spec.
How the five-day sprint does it
The same sprint Cosmic runs for new products, pointed at the app you already have. The days run back to back and take about an hour a day of your time.
Day 1 · Discover and frame
Agree on the outcome and the users, run the production checklist against your app, and pick what the week fixes.
Day 2 · Build
Fix the core workflow end to end, test first, and iterate on it with you the same day.
Day 3 · Test
Real users try the hardened build; what they do reopens discovery, and the team fixes what they trip on.
Day 4 · Iterate
A second round with users, final fixes and a rehearsed release on your infrastructure.
Day 5 · Launch
Ship to production, switch on monitoring and measurement, and hand over the code and the next steps.
Full detail on the sprint page.
What it costs and what you keep
$10,000, fixed, for five days. There’s no hourly billing and no change orders inside the week. You keep the running app on your accounts, the code with tests, notes from two rounds of user testing, and a 90-day roadmap. A short call comes first, and if the app won’t fit in a week, we’ll say so.
Frequently asked questions
Can a Lovable app work in production?
Often, with work. Lovable apps run on a real stack (React with a Supabase backend), so the gap is usually configuration and coverage: row-level security, keys in the client, auth edge cases, backups and tests. It's rarely a rewrite.
How do you take a Replit app to production?
Replit can publish an app, but production also means a separate production database, secrets kept out of the code, tests on the core workflow, monitoring, and a deploy you can roll back. The sprint sets those up on accounts you own, on Replit or off it.
Do I need to rewrite my vibe-coded app?
Usually not. Rewrite only the parts that are wrong at the root, most often auth or the data model, and keep what works. The table above covers when a full rebuild makes sense.
How much does it cost to make a vibe-coded app production-ready?
Cosmic's sprint is $10,000, fixed, for five days, covering one core workflow for one type of user. A short call comes first to confirm the app fits in a week, before you pay anything.
Who owns the code after the sprint?
You do. The repository, cloud account, domain and database are yours, and nothing runs on accounts Cosmic controls.