How to fix a vibe-coded MVP built with Lovable, Bolt or Cursor (before it breaks in production)

I'm Illia Kulbachnyi, CEO of Cosmos Studio and a member of the Awwwards jury. This year more founders come to us with the same story: "We built the MVP in Lovable (or Bolt, or Cursor) in a few weeks. Now real users are signing up, an investor wants a technical review, and every new prompt breaks something." This guide is for that moment. It explains what usually goes wrong, how to decide between fixing and rebuilding, and what a production-ready version should have.

What is a vibe-coded MVP, and why does it break?

Collins Dictionary named "vibe coding" its Word of the Year 2025 and defines it as the "use of artificial intelligence prompted by natural language to assist with the writing of computer code". The term comes from Andrej Karpathy, who described it as giving in to the vibes and forgetting "that the code even exists".

That is exactly why it works for an MVP: you describe what you want, and tools like Lovable, Bolt.new, v0, Replit or Cursor write it. And it is why the MVP breaks later. Nobody on the team has read the code closely, so nobody knows which parts are safe.

The risk is real. In its 2025 GenAI Code Security Report, Veracode tested 80 coding tasks across more than 100 large language models. AI-generated code introduced security vulnerabilities in 45% of cases, and the models failed to protect against cross-site scripting in 86% of the relevant cases. The code runs. It just isn't checked.

What are the warning signs your AI-built app is not ready?

If two or more of these sound familiar, it is time for a review by senior engineers:

• Every fix breaks something else. You ask the AI to fix one bug, and two features that worked yesterday stop working.
• You are afraid to regenerate. The code base is so large and tangled that each new prompt feels like a gamble.
• Nobody has checked security. You are not sure whether API keys sit in the front end or whether one user can read another user's data.
• Login and payments fail for real users. Password reset, plan changes or Stripe webhooks work in the demo but not in real life.
• It slows down as data grows. Pages get slower, hosting costs climb, and there are no backups or monitoring.
• Investors or big customers ask about the code. You need to pass a technical review, and you can't explain how the app works.

What breaks most often in Lovable, Bolt and Cursor apps?

1. Database access rules. Many of these apps use Supabase. Supabase's own docs say the publishable key is "safe to expose with RLS enabled" and that you should "never expose your service role or secret keys on the frontend". If row-level security (RLS) is off or too loose, anyone with the public key can read or change data. Apps from AI builders often ship with these rules switched off or left too open, so one user can read other users' data. Check the rules yourself before real users sign up.

Lovable has added a security scan before publishing and an AI security reviewer, and says it now blocks private API keys from being pasted into code. These help, but Lovable itself writes that it "can't guarantee your app will be 100% secure". A scan is a start, not a review.

2. Access control in general. Broken access control is number one in the OWASP Top 10:2025, the most widely used list of web app risks. In AI-built apps it often looks like this: the screen hides a button, but the API behind it still lets anyone call it.

3. Payments. Stripe's documentation warns that webhook endpoints "might occasionally receive the same event more than once" and that Stripe "doesn't guarantee the delivery of events in the order that they're generated". It also tells you to verify every event's signature. Demo code rarely does any of this, so the first real double charge or failed renewal becomes a support ticket.

4. Business logic in the browser. AI tools tend to put prices, limits and permissions in front-end code because it is the fastest way to make the screen work. These rules belong on the server.

5. No production setup. One environment, no staging, no backups, no error logging. You find out about problems from angry users.

6. Generic UX. AI tools copy common interfaces. Onboarding, empty states and the core flow usually need a designer before people pay for the product.

Should you fix, refactor or rebuild a vibe-coded app?

This is the most expensive decision in the whole rescue, so make it after an audit, not before. Here is how the three options compare:

In our experience most AI-built MVPs land in the middle row. A full rewrite throws away weeks of real product learning, while endless prompting just moves the risk around.

How do you take a vibe-coded MVP to production? A step-by-step plan

Step 1. Freeze and back up. Put the code in a Git repository you own. Lovable, for example, syncs with GitHub. Stop large AI regenerations until the audit is done.

Step 2. Audit before you change anything. Review the code, database rules, secrets, infrastructure and the key user flows. The output should be a ranked list: what is safe, what is risky and what each fix costs.

Step 3. Fix the risks first. Close data leaks, move secrets to the server, turn on and test RLS, and check that every API route checks who is calling it. New features wait.

Step 4. Make money flows boring. Verify webhook signatures, log processed event IDs so duplicates are ignored, and handle failed payments and plan changes. Add tests around everything that touches money or personal data.

Step 5. Move business logic to the server and clean the data model. This is what stops new features from breaking old ones.

Step 6. Set up production. Separate staging and production, CI/CD, backups, error logging and monitoring, on hosting you control.

Step 7. Finish the product. Now rethink onboarding, the core flow and the design system, so the product looks as solid as it now is.

This is the same stack and discipline we use for our own builds. For SerenX, our team built the site in-house with React, TypeScript and Vite – the same front-end base many Lovable and Bolt apps start from.

Production-readiness checklist for an AI-built MVP

• The code is in a repository you own, with a working backup.
• Row-level security is on for every table, and it is tested as an anonymous user and as a second user.
• No secret keys in front-end code or in the repository.
• Every API route checks who is calling it and what they may do.
• Prices, limits and permissions are enforced on the server.
• Payment webhooks verify signatures and ignore duplicate events.
• Failed payments, plan changes and password reset are tested end to end.
• Staging and production are separate, with automatic deploys.
• Errors are logged, and someone gets an alert when things break.
• Database backups run and a restore has been tested once.
• Onboarding, empty states and error messages were reviewed by a designer.

How Cosmos Studio rescues vibe-coded MVPs

Cosmos Studio is a 10-person senior design and development team founded in 2018, with 500+ projects and 60+ international design awards, including Red Dot, 18 Awwwards, 3 FWA and 25 CSS Design Awards. Our vibe code rescue service takes over apps built with Lovable, Bolt, v0, Replit, Cursor and similar tools. We also have dedicated pages for Lovable, Bolt, Cursor and Replit projects.

How it works:

1. Audit. Every rescue starts with an audit from $2,000 that takes 1–2 weeks. We review the code, database, security, infrastructure and UX and show you what is safe, what is risky and what it will take to fix.
2. Keep or rebuild. We decide together what to keep, refactor and rebuild.
3. Fix and finish. Security and payments first, then the missing features, tests and UX.
4. Launch and hand over. Production hosting, monitoring and backups, plus detailed documentation so your team can keep building – with or without AI tools.

Front-end and design are done in-house. Backend, cloud and security work is done with senior engineers we partner with on every project. You keep full ownership: we work in your repository and accounts and sign an NDA from the first call. After the audit, fixes are billed from $50 per hour.

Product thinking matters as much as code here. For Loamly, an AI-native CRM, we designed the product logic, UX and UI together with Obriy Design Büro, so complex sales funnels stay easy to work with every day.

We use AI tools in our own work too. For Mad Dogs we generated the visuals with AI and built the scroll-based website in custom HTML and JavaScript in a few weeks. So we know where these tools save time and where a human has to take over.

Not sure if your app needs a rescue? Start with a UX audit or get an instant range with our pricing calculator.

Sources

• The Register: "Vibe coding" named Collins Word of the Year 2025
• Veracode: AI-generated code poses major security risks in nearly half of all development tasks (2025)
• Supabase docs: Securing your data
• Lovable: Secure vibe coding
• OWASP Top 10:2025
• Stripe docs: Receive Stripe events in your webhook endpoint

{{case}}

{{contact}}