You built it with AI. Now it needs an engineer.

A vibe-coded app is software built primarily by describing what you want to an AI tool — Claude Code, Cursor, Lovable, Replit, Bolt, v0, Windsurf, Base44 and similar — rather than by writing the code yourself. The term covers everything from a weekend prototype to a product with paying customers, and the approach genuinely works for getting something real built quickly. What it does not reliably produce is the layer underneath: access control, error handling, tests, and the parts that only matter once other people are using it.

The fastest self-check is to sign out, then try to read another user's data directly from your API rather than through the interface. If it returns data, your access rules are not protecting you. Beyond that, check whether any secret key is in your repository or browser bundle, whether payment webhooks verify their signatures, and whether permission checks run on the server rather than only hiding buttons in the interface. We publish a step-by-step version of these checks that you can run yourself for free.

The measured picture is more specific than a yes or no. Veracode's testing found that 45% of AI-generated code samples failed security tests, and that while models improved dramatically at writing syntactically correct code between 2023 and 2025, the proportion passing security tests stayed flat at roughly 45–55%. Separately, Apiiro found that AI-assisted development reduced shallow defects like syntax errors while substantially increasing deeper ones such as architectural flaws and privilege-escalation paths. The pattern is not that AI writes bad code; it is that AI fixes the obvious problems and amplifies the subtle ones.

Fixing is usually cheaper, and you should be sceptical of anyone who recommends a rebuild before reading your code, because rebuilds are the most expensive thing a vendor can sell you. Working software encodes a lot of decisions about what your product actually needs, and rebuilding discards those along with the problems. Rebuilds genuinely make sense when the data model cannot support what the product now does, or when the app is small enough that rebuilding is measured in days.

Published prices in this market range from roughly $20 on freelance marketplaces to $50,000 or more for full agency rescues, for work described in similar language. The spread reflects genuinely different things being sold: a single bug fix, a fixed-price audit report, a multi-week remediation, or a full rebuild. We publish a comparison of what different price points actually buy, including our own, so you can work out which one your situation calls for.

Ask any vendor — including us — to walk you through a specific commit and explain why it is written that way, what it would break, and what happens when it fails. Someone who understands the code answers immediately; someone who generated it without reading it cannot. We do use AI tools, because not using them in 2026 would make us slower without making the work better. The distinction that matters is not whether AI was involved but whether a person reviewed it, tested it, and can defend it.

Yes, and most clients should. The arrangement that works is a clear boundary: you keep iterating on the interface and product surface, engineers own the data layer, authentication, and payments. What causes problems is both parties editing the same files with different assumptions about how the system is structured.

No. A large share of the people in this situation have never worked as engineers, which is precisely why the AI tools were valuable to them. What we need from you is the product knowledge — what the app is for, who uses it, what matters most — and we handle the engineering vocabulary.