How much does vibe code cleanup cost?

The audit is a fixed fee. Most cleanups then land in the $8k - $50k range: closing the security findings on a small app is at the low end, and a data-model migration with billing and performance work is at the top. The cleanup is billed per two-week step, so you can stop after the security work if that's all you need.

How long does it take?

The audit takes a week. Security findings are usually closed within a month. A full cleanup with data model, billing, and performance runs eight to twelve weeks. The app stays live the whole time.

Which tools do you work with?

Lovable, Bolt, v0, Replit, Cursor, Windsurf, Claude Code, and anything else that produces a Next.js, React, Supabase, or Node codebase. If it's a different stack, send it over and we'll tell you in a day whether it's a fit.

Will you tell me to rewrite it?

Only if the audit shows the data model or framework can't carry the product. That's rarer than most developers will tell you. Most apps we see need security, billing, and structure fixed, and the product itself is fine. If a rebuild is the honest answer, we'll scope that instead and you'll have the audit to show why.

Can I keep using the AI builder after the cleanup?

Yes, with guardrails. Once access is enforced by the database and tests cover the main paths, a future prompt that forgets a check gets caught before it ships. We'll set up the repo so you or your builder can keep working in it safely.

What if we want to change scope mid-cleanup?

Expected. Findings get fixed in priority order, two weeks at a time, so a new priority goes into the next step. The one thing we fix early, because it's expensive to reverse, is how customer data is separated.

What happens after the cleanup?

Your choice. Some founders keep us on a monthly retainer to keep shipping features on the cleaned-up codebase. Others take the walkthrough and hand it to their first engineer. Either way you own the code, the data, and the accounts.

Who will I be working with, and how often do we talk?

A small, fixed team with one lead you talk to directly. A live demo of what was fixed every two weeks, a shared channel for questions in between.

Do I need to stop selling while you work?

No. Every fix deploys behind the same URL with the tests passing. Data-model changes go through a zero-downtime migration. Your customers see a faster, safer app.

You do. Code, data, accounts, and the audit report, from day one.

Vibe Code Cleanup

You Proved It Works. We Make It Hold Up.

Apps built with Lovable, Bolt, Cursor, Replit, or v0 with real users and the first signs of trouble. A fixed-fee audit tells you exactly what's at risk, then we fix security, data, auth, and billing in the order that protects your customers. You keep everything that works.

Available for new projects

Who This Is For

If one of these is you, keep reading.

Founders With Paying Customers on a Prototype

Built on Lovable, Bolt, or Replit, got traction, and now every bug has a name attached.

Teams Whose Internal Tool Became Load-Bearing

Someone vibe-coded a tool for one team. Now three departments run on it and nobody dares change it.

Anyone Who Has Had a Security Scare

A customer saw someone else's data, a key leaked, or a scanner flagged the app. You need it closed and proven closed.

Startups Heading Into Diligence

A raise or an acquisition where someone technical is about to read the code.

Founders About to Hire Their First Engineer

You want a codebase a good developer says yes to.

Why Clean It Up Now

Six reasons founders come to us with a working app.

You Have Paying Customers on It

The prototype became the product. Every bug is now someone's invoice, and every outage is a refund conversation.

Something Broke and You Couldn't Fix It

The AI that built it can't explain it. A change in one place breaks three others, and nobody knows why.

A Customer Asked About Security

Your first serious buyer wants to know where their data lives and who can see it. You need a better answer than the builder's default settings.

It Falls Over With Real Traffic

Ten users was fine. A hundred and the pages crawl, the database bill spikes, and the same query runs four hundred times.

An Investor Wants Diligence

Someone is about to put money in and their technical adviser wants to see the codebase. What they find decides the terms.

You Want to Hire an Engineer

The first developer you show it to will either quote a rewrite or walk. A cleaned-up codebase is one they can join.

What Makes AI-Built Apps Fragile

The app works. That's what makes the problems hard to see.

Every User Can See Every User

Row-level security off, or a policy that says everyone is allowed. 170+ Lovable apps leaked emails, API keys, and payment details this way in one disclosure.

Secrets in the Front End

Service keys, API tokens, and admin credentials shipped to the browser, where anyone who opens dev tools can read them.

Insecure by Default

Given a secure and an insecure way to write something, AI models pick the insecure one 45% of the time. Nobody chose it, and nobody reviewed it.

Billing That Almost Works

A checkout page wired to Stripe with no webhook handling, so cancelled customers keep access, failed payments go unnoticed, and refunds are done by hand.

No Tests, No Safety Net

Nothing checks that a change didn't break something. Every deploy is a guess, and the guess gets worse as the codebase grows.

A Data Model Nobody Designed

Tables added one prompt at a time. Duplicated fields, missing relationships, and no idea which record is the real one.

AI-Built Code in Numbers

The numbers behind auditing first and fixing security before anything else.

45%

of the time, AI models choose the insecure way to write code when a secure one exists.

170+

production Lovable apps exposed customer data through missing row-level security in one disclosure.

72%

security failure rate for AI-generated Java, the worst of the languages tested.

Sources: Veracode, GenAI Code Security Report (2025) · CVE-2025-48757, via Superblocks · Veracode, GenAI Code Security Report (2025)

Where Cleanups Go Wrong

Five ways the fix costs more than the problem, and how we avoid them.

Rewriting From Scratch

The first developer to see it says start over. Six months later you have a second app with the same problems and no customers left on the first.

Fixing Everything at Once

A three-month refactor with nothing shipping. The bugs customers are hitting today stay unfixed while the architecture gets perfected.

Patching Security in the App Code

One missing check in one route and the leak is back. Access has to be enforced by the database.

Cleaning Up Without Tests First

Refactor first, test later, and you can't tell what you broke. The tests that lock in current behaviour have to exist before anything moves.

Losing What Worked

The prototype got customers because it did something right. A cleanup that changes how the product feels throws that away.

How We Clean It Up

We build our own products on the same stack these tools generate. We know what the builders get wrong, and what they get right.

Audit Before Anything Moves

Security, data model, auth, billing, tests, and performance, each scored and ranked by what could lose you a customer. You get the report whether or not we do the work.

Keep What Works

The screens your customers like stay. We fix what's underneath them. If a rebuild really is cheaper, we'll say so in the audit and scope that instead.

Security Enforced by the Database

Row-level policies on every table, secrets moved server-side, and permissions that hold even when a future prompt forgets to add a check.

Tests That Lock In Today's Behaviour

Before we change anything, tests capture what the app does now. Then every cleanup step has to keep them passing.

Billing Built to Last

Webhooks handled, every Stripe event safe to retry, cancelled customers locked out, failed payments chased. Nobody pays twice or uses what they didn't pay for.

A Codebase an Engineer Can Join

Structure, naming, a README that's true, and a deploy that isn't a guess. The next hire spends week one shipping.

What we build with

Next.js
React
TypeScript
Supabase
PostgreSQL
Stripe
Vercel
Node.js
Prisma

Built the same way: Receivables · Banyan · Egis · Lift

Why We Fix It in Priority Order

A three-month rewrite with one relaunch is how a working app loses its customers. We ship a fix every two weeks, starting with whatever could hurt you most.

The Biggest Risk Closed in Weeks

The audit's top finding, usually a data leak between users, is fixed and deployed inside the first month. You're safer by week three.

The Audit Steers the Roadmap

Every finding is scored by how likely it is to lose you a customer. That order is the plan. Cosmetic problems wait until the ones that cost money are closed.

Stop at Any Point

Every two weeks you see a live demo of what was fixed and make a decision: keep going, change direction, or stop. You are billed per step, so if you stop, you pay for what shipped.

Change Your Mind Cheaply

New findings or new priorities go into the next step. The one thing we fix early, because it is expensive to reverse, is how customer data is separated.

Tests Before Refactors

Nothing gets restructured until a test proves what it does today. If a cleanup step breaks something, the test says so before your customers do.

No Relaunch

The app your customers are using is the app we're fixing. Each improvement deploys behind the same URL. There's no big-bang version two and no migration day.

How a Fixed-Price Cleanup Runs

Audit first, then fixes in two-week steps, riskiest first. You own the code throughout, and the app stays live the whole time.

Typical timeline: 4-12 weeks
Audit report: Week 1
Live demo: Every 2 weeks

01
Audit
Week 1
A fixed-fee week. We read the code, probe the database, trace the auth and billing flows, and load-test the main paths. Every finding scored by how likely it is to lose you a customer. You keep the report whether or not you go ahead.
- Scored findings report
- Fix-or-rebuild verdict
- Fixed price for the cleanup
02
Lock In Current Behaviour
Week 2
Tests that capture what the app does today, on the paths customers use. Nothing is restructured until they pass.
- Test suite on critical paths
- Staging environment
03
Close the Security Findings
Week 2-4
Row-level security on every table, secrets moved server-side, auth flows fixed, and permissions enforced by the database.
- Security findings closed
- Access enforced by the database
- Live demo every 2 weeks
04
Fix the Data Model
Week 4-6
Duplicated fields merged, relationships made explicit, and a migration that moves live data without downtime.
- Clean data model
- Zero-downtime migration
05
Make Billing Hold Up
Week 5-8
Webhooks handled, every event safe to retry, access tied to subscription state, failed payments chased automatically.
- Billing wired to Stripe events
- Admin refund and access tools
06
Performance and Structure
Week 7-12
The queries that run four hundred times fixed, the code organised so the next engineer can find things, a deploy that runs the tests first.
- Load-tested
- Deploy pipeline
- README that's true
07
Handover or Keep Building
Ongoing
A walkthrough for you or your first hire, then a monthly retainer to keep shipping, or a clean handover. Either way the code is yours.

What It Costs

1Audit week

Fixed fee

Ends with every finding scored, a fix-or-rebuild verdict, and a fixed price for the cleanup. Yours whether or not you go ahead.

Scored findings
Fix-or-rebuild verdict
Fixed price

2The cleanup

$8k - $50k

The cleanup moves with how many findings are critical, whether the data model needs a migration, and how much billing has to be rebuilt. Closing the security findings on a small app sits at the low end; a full data-model migration with billing and performance work sits at the top.

Billed: Per 2-week step
Stop: After security if that's enough
App stays: Live, same URL

Fix or Rebuild

The audit answers this before you spend anything on the cleanup.

Fix When

The data model is roughly right, customers like the product, and the problems are security, billing, and structure. Most apps we audit land here.

Rebuild When

The data model can't support what the business needs next, or the framework the builder chose can't do what you're selling. Rarer than the first developer you ask will tell you.

Usually a Bit of Both

Keep the front end and the workflows customers know. Rebuild the database and the billing underneath them. Ship it behind the same URL.

What the Audit Covers

Six areas, each scored, each with a finding you can act on.

Security

Row-level policies, secrets, auth flows, injection, and what a logged-in user can reach that they shouldn't.

Data Model

Duplicated fields, missing relationships, and whether the schema can carry the next year of features.

Billing

Webhook handling, retry safety, access tied to subscription state, and what happens on a failed payment.

Tests and Deploys

What's covered, what isn't, and whether a deploy can break production without anyone noticing.

Performance

Queries per page, what happens at ten times today's users, and where the database bill is going.

Maintainability

Whether a new engineer could ship a change in their first week, and what's stopping them.

Common Questions

If yours isn’t here, book a call and ask.

Find Out What's Actually at Risk.

Tell us what it's built on and what's worrying you, on the call. If it's a fit, you give us read access to the repo, and one audit week later you have every finding scored, a fix-or-rebuild verdict, and a fixed price to close the ones that matter.