---
title: "Take your vibe-coded app to production — Cosmic"
description: "Take the core workflow of a Lovable, Replit, Bolt, v0 or Cursor app to production: auth, data access, secrets, tests, deploys and monitoring in 10 days."
canonical: "https://www.cosmiclabs.net/vibe-coded-app-to-production"
---

# Take your vibe-coded app to production.

A vibe-coded app is ready for production when strangers can use it without breaking it, leaking data or needing you in the loop. That takes real authentication, access rules on the data, secrets kept off the browser, tests on the core workflow, a deploy you can roll back, and monitoring. Cosmic starts with a 10-day sprint that takes your app's core workflow to production and maps what the rest of the app needs. You keep the code and every account.

[Schedule a call](https://www.cosmiclabs.net/contact)

Built in Lovable, Replit, Bolt, v0 or Cursor? Tell us what you have.

## Functional is the easy part

Pivotal Labs teams judged software on a simple pyramid: Functional, Useful, Usable, Joyful. The best products reach all four. AI builders have made the bottom layer quick to build. The three above it still take product work.

Case in point: Saad Ahmed, Cosmic’s founder, built a partner sales room and CRM app called Tandem over nights and weekends. 35,000 lines of TypeScript. 90 React components. 22 database models. 84 API endpoints. It worked in 20 days.

> “Though I could quickly fill in the Functional part of the triangle and vibe-code a bunch of features within three weeks, it still took two more weeks just to get load times under five seconds, address 28 security vulnerabilities, add rate limiting, deal with CSRF, and eliminate header injection in file downloads.”
>
> Saad Ahmed, founder, Cosmic

![The software hierarchy of needs as a pyramid: Functional at the base, then Useful, Usable and Joyful. AI app builders make Functional easy to build; the levels above are still hard to get to.](https://www.cosmiclabs.net/brand/production/software-hierarchy-of-needs.jpg)

Pivotal Labs’ software hierarchy of needs.

## What production-ready means for an AI-built app

The checks the sprint runs on day 1. Each one is a way vibe-coded apps commonly fail once strangers use them, and each comes with a way to check your own app in a few minutes.

| Check | What breaks without it | How the sprint verifies it | Check it yourself |
| --- | --- | --- | --- |
| Authentication and sessions | Accounts can be taken over, or pages meant for signed-in users are open to anyone. | Sign-up, password reset, session expiry and admin routes are tested with real accounts. | Open an admin or account page in a private browser window. You should be sent to sign in. |
| Access rules on the data | One user can read or change another user's records. | Every table's access policy is checked (for example, row-level security in Supabase) and tested with two separate accounts. | On Supabase, open Advisors → Security Advisor; it flags tables with row-level security off. Then sign in as one user and request another user's record by its ID. |
| Secrets | API keys shipped to the browser get used by strangers, on your bill. | The built app is searched for keys; secrets move server-side and get rotated. | Run gitleaks detect on the repository, and search your live site's JavaScript (browser DevTools → Sources) for sk_, service_role or secret. |
| Data model | Duplicate or orphaned records pile up as usage grows. | The schema is reviewed and gets the constraints and migrations it's missing. | In your database's table editor, look for tables with no foreign keys or unique constraints, and for columns that store IDs as plain text. |
| Tests on the core workflow | Every change risks breaking the one thing the app exists to do. | Tests cover the core workflow and run before every deploy. | Run npm test. If there's no test script, or it finishes in a second, the core workflow isn't tested. |
| Deploys and rollback | A bad release takes the app down with no quick way back. | A repeatable deploy to your own accounts, with a rollback path. | In your host's Deployments list (Vercel, Netlify, Railway), find the previous deploy and check you can promote or redeploy it. |
| Monitoring and backups | You hear about outages from users, and lost data stays lost. | Error tracking, uptime checks and backups that have been restored once to prove they work. | Find when your database was last backed up and whether anyone has restored one. Check whether an error tracker such as Sentry is installed. |
| Ownership | The app, database or domain lives in someone else's account. | Code, cloud, domain and database end up in accounts you own. | In GitHub, your host, your database and your domain registrar, check that the owner is your company's account. |

## What usually breaks first

Here’s what broke on Tandem after the functional version was done. Those are one app’s numbers, and yours will differ. The checklist above is how the sprint looks for each of them in your app.

- **Slow starts**: Cold starts took 120 seconds, partly because the Neon Postgres database suspended after 5 minutes idle. Load times came down to under 5 seconds.
- **Chatty data access**: Seven sequential database queries on every request. Saad calls these the silent app killers.
- **Security gaps**: 28 security vulnerabilities, including CSRF and header injection in file downloads.
- **No limits**: Nothing stopped a user or a bot from hammering the API until rate limiting went in.
- **The same bugs, again**: An "Anti-Patterns" doc for Claude Code so it stops repeating itself: 21 entries so far, each a production bug the agent introduced and then had to fix.

## Fix it or rebuild it?

### Fix it

The data model mostly fits the product, the core workflow works for real users, and the problems are configuration, coverage and hardening. This is the common case.

### Rebuild part of it

One area is wrong at the root (often auth or the data model) while the rest holds up. Replace that area behind the same screens.

### Rebuild it

Nobody can explain how it works, the data model fights every new feature, and fixes keep breaking other things. Keep the prototype as the spec.

## How the 10-day sprint does it

The same sprint Cosmic runs for new products, pointed at the app you already have. It runs over about two weeks and needs about an hour a day of your time.

1. **Days 1–2 · Discover and frame**: Agree on the outcome and the users, run the production checklist against your app, and pick what the sprint fixes.
2. **Days 3–4 · Build**: Fix the core workflow end to end, test first, and iterate on it with you the same day.
3. **Days 5–6 · Test**: Real users try the hardened build; what they do reopens discovery, and the team fixes what they trip on.
4. **Days 7–8 · Iterate**: A second round with users, final fixes and a rehearsed release on your infrastructure.
5. **Days 9–10 · Launch**: Ship to production, switch on monitoring and measurement, and hand over the code and the next steps.

The same 10-day sprint builds new products too; see [MVP development](https://www.cosmiclabs.net/mvp-development).

## What you keep

There’s no hourly billing and no change orders inside the sprint. You keep the running app on your accounts, the code with tests, notes from two rounds of user testing, and a 90-day roadmap. A short call comes first, and if the app won’t fit in 10 days, we’ll say so.

## Frequently asked questions

### Can a Lovable app work in production?

Often, with work. Lovable apps run on a real stack (React with a Supabase backend), so the gap is usually configuration and coverage: row-level security, keys in the client, auth edge cases, backups and tests. It's rarely a rewrite.

### How do you take a Replit app to production?

Replit can publish an app, but production also means a separate production database, secrets kept out of the code, tests on the core workflow, monitoring, and a deploy you can roll back. The sprint sets those up on accounts you own, on Replit or off it.

### Do I need to rewrite my vibe-coded app?

Usually not. Rewrite only the parts that are wrong at the root, most often auth or the data model, and keep what works. The table above covers when a full rebuild makes sense.

### How much does it cost to make a vibe-coded app production-ready?

We quote the 10-day sprint on a short first call, once we've confirmed the app fits in 10 days. It covers one core workflow for one type of user; how long the rest of the app takes depends on its size and complexity, and you don't pay anything before that call.

### Who owns the code after the sprint?

You do. The repository, cloud account, domain and database are yours, and nothing runs on accounts Cosmic controls.

## Make the app you have ready for real users.

[Schedule a call](https://www.cosmiclabs.net/contact)