Skip to content
vibecoder.expert

vibecoder.expert / Production readiness

Your AI built the app. I make sure it survives production.

Audits, fixes, and field guides for founders and indie hackers shipping apps built with Lovable, Bolt, Cursor, and Claude Code.

Get a production audit Run the free checklist
saas-dashboard · built with Lovable TYPICAL FIRST AUDIT
  • HTTPS enforced PASS
  • API keys server-side FAIL
  • Supabase RLS enabled FAIL
  • Auth on API routes FAIL
  • Rate limiting FAIL
  • Error handling FAIL
  • Input validation FAIL
  • Database backups FAIL
  • .env in .gitignore PASS
  • Payment webhook signatures FAIL
Verdict FAIL — 2/10

Section 01 / Diagnosis

Why vibe-coded apps fail

Every one of these comes from real audit work, not theory. AI coding tools optimize for "works in the demo" — these are the gaps that surface when real users arrive.

01 / FAIL

Leaked API keys

AI tools happily call OpenAI or Stripe straight from the browser, key included. Anyone can read it in dev tools and spend on your account. I have seen four-figure bills from a single leaked key on a demo app.

02 / FAIL

Missing Supabase RLS

Your anon key is public by design — Row Level Security is the only lock on the database. AI builders skip it because the app works fine without it in testing. Then any visitor can read every table.

03 / FAIL

No real error handling

Generated code handles the happy path you demoed. When Stripe times out or the API rate-limits, vibe-coded apps swallow the error, leave data half-written, and tell no one — including you.

04 / FAIL

No backups, no rollback

One bad migration or one wrong prompt away from losing everything, with no restore path. A backup that has never been test-restored is a hypothesis. Most AI-built apps have neither.

Section 02 / Instruments

Free tools

Client-side, no signup, no data leaves your browser.

Security Checklist →

20 checks, live PASS/FAIL verdict, copy the report as markdown.

PRD Generator →

Turn an app idea into a structured spec optimized for Lovable, Bolt, and Claude Code.

AI Coding Cost Calculator →

Compare monthly costs of Cursor, Claude Code, Lovable, Bolt, and Replit at your usage.

llms.txt Generator →

Generate a valid llms.txt so AI engines can read and cite your site.

Section 03 / Field guides

Latest guides

All guides →

Section 04 / Inspector

Who runs this

Field Notes

One production-hardening tip per week. No fluff.

The exact checks I run on client codebases, one email at a time. Unsubscribe whenever.