Guide · AI-built apps
I vibe-coded an app. Now what?
You built something with Lovable, Bolt, Replit, Base44, v0 or Cursor, and it works. Here's what to do before real people and real data arrive.
You've done the hard bit people used to pay for
A few years ago, getting an idea onto a screen meant a developer, a quote and a few months. You've done it in an evening or two. That's genuinely useful, and we're not here to tell you off for it. We build with AI ourselves every day.
The catch is that a tool that builds an app in an afternoon is very good at the bits you can see and much less careful with the bits you can't: who can read what in the database, where your keys are kept, what happens with a hundred users instead of one. So the question after "it works" is "is it safe to let other people use it?" The steps below are in the order we'd do them.
Make sure you own it
Before anything else, write down every account your app touches, and check each one is in your name or your company's, with a login you control. That usually means:
- the builder account itself (Lovable, Bolt, Replit and so on)
- the database and login service, often Supabase or the builder's own cloud
- GitHub, if you've connected it
- the domain name and wherever its DNS lives
- any payment, email or AI service the app calls, such as Stripe or OpenAI
If a friend, a freelancer or an agency set any of these up under their own account, move it now while everyone's still talking. It's a five-minute job today and a very awkward one later. Our guide on what to do when your developer leaves has the full checklist.
Lovable app export: get a copy of the code out
Your code living only inside the builder is fine for a prototype and risky for a business. Get a copy into a GitHub repository you own.
On Lovable, GitHub sync is available on every plan and works both ways: changes made in Lovable appear in GitHub, and changes pushed to the connected branch flow back into Lovable. Paid plans can also download the codebase directly (Lovable's GitHub docs). Bolt and Replit both offer ways to get your code into GitHub or a download too; check their current docs, because these menus move.
One thing that catches people out: the code is only part of the app. If your data lives in Lovable Cloud, it doesn't come with the code. Lovable's own guide moves it to your own Supabase project table by table, with logins set up again by hand (Lovable's self-hosting guide), and Supabase says there's no automated way to transfer a Lovable Cloud project to your own Supabase account (Supabase docs). Keys and secrets stored in the builder need re-entering wherever the app goes next. Better to know that now than on launch day.
Check the security before anyone else logs in
This is the step people skip and the one that hurts. The common problems in AI-built apps are dull and serious: database tables any logged-in user can read, keys sitting in code the browser can see, admin pages anyone can reach if they guess the address, and no limit on how often someone can hammer your login.
You don't need to be a developer to find most of them. Our vibe-coded app security checklist walks through the checks in plain English, and the AI app risk scorecard gives you a quick score in two minutes. If your app holds personal data, takes payments or will be used by a client's staff, get a person to read the code as well.
How to deploy and launch a vibe-coded app
You've got two broad routes, and both are legitimate.
Keep it on the builder's hosting
The simplest option. On Lovable, publishing to a lovable.app address is free on all plans, a custom domain needs a paid plan, and Lovable sets up the SSL certificate for you (Lovable's custom domain docs). For a small internal tool or an early product with a handful of users, this is often all you need. The trade-off is that you're tied to the builder's pricing and limits.
Move it to hosting you control
Once the app matters to the business, it usually wants to live somewhere you control: proper hosting, your own database, backups you've tested and somebody watching it. That's a bigger job and it's where things break, so we've written it up separately in getting your AI-built app live, covering hosting, exporting, databases and what tends to go wrong.
Either way, before launch
- Turn on backups for the database, and try restoring one. Our guide on how to test your backups explains how.
- Check what happens when something fails: a payment that doesn't go through, an email that bounces, an AI call that times out.
- Set up an alert so you hear about errors before your users tell you.
- Write down how it all fits together. Future you, or a developer, will thank you.
Keep going alone, or bring in a developer?
Plenty of vibe-coded apps never need a developer, and that's fine. Carry on by yourself if it's a personal tool, a prototype to show investors or customers, or something only you and a couple of colleagues use.
Bring someone in when any of these are true:
- it stores other people's personal data, or takes money
- customers or a client's staff depend on it being up
- every change you ask the AI for breaks something else
- you're about to move it off the builder
- you can't explain what a part of it does, and that part matters
"Bring someone in" doesn't have to mean starting again. Most AI-built apps don't need rebuilding; they need someone to read them, fix the holes and put proper foundations underneath. Our guide to hiring a developer to finish your AI app covers what to ask and what to watch out for.
Fix my vibe-coded app: where we come in
We're Rob, Jason and a small team in Gravesend, and we've been building business software since 2011. We use AI every day, because it makes us faster and cheaper than traditional development. The difference is that an experienced developer decides what gets built and checks every line before it goes live. Not anti-AI, just anti-slop.
For apps that already exist, we usually start with an AI Code Audit: a fixed-price written review of security, database, scale and maintainability, so you know what you've got before you spend anything fixing it. If it needs work, our AI-built app rescue makes it safe and turns it into something you can build on.
What people ask
Check you own the code and every account it runs on, get a copy of the code into GitHub, check the security before anyone else uses it, then launch it somewhere you control with backups switched on. If it will hold other people's data or take money, have a developer read it first.
Yes. Lovable can sync your project to a GitHub repository on every plan, and paid plans can download the codebase directly. Data in Lovable Cloud does not come with the code: Lovable's guide moves it to your own Supabase project by hand, and logins have to be set up again.
For small apps and early products it often is: publishing is free, custom domains need a paid plan, and SSL is set up for you. Once the app matters to the business, most people want it on hosting they control, with their own database, tested backups and monitoring.
Run through a security checklist: who can read each database table, whether any keys are visible in the browser, whether admin pages are protected, and whether logins are rate limited. If it holds personal data or payments, have a person read the code as well, because automated checks miss things.
Usually not. Most AI-built apps need someone to read them, fix the security holes and put proper foundations underneath, not a rewrite. A rebuild is only worth it when the structure underneath can't carry what the business needs, and a good developer will show you why before suggesting it.
Further reading
Tell us about your app
Tell us what you built and what you're worried about, and we'll tell you where we'd start.
Which tool you used, what the app does, and whether it holds anyone's data or takes payments. If it's fine as it is, we'll say so.
What we will cover:
- Whether it's safe to launch as it is
- What we'd check first
- Whether it needs fixing or just tidying
- What an audit would cover
Rather talk now? Book a call or ring 01474 639 089.
We reply within one working day.
