Audit the generated code
Reading the repository, dependencies, component structure and business logic. We identify what can be kept as is, what needs to be restructured and the few points that block a production release.
From vibe coding to an app in production
Take Over a Lovable or Bolt App and Ship It to Production
Lovable, Bolt or Cursor let you build a working app fast. We check what the tool generated (security, data, tests, deployment), then hand it back to you in production, documented and maintainable, with our tech leads overseeing the work.
A free 30-minute video call, with no commitment, followed by a written summary with a ballpark estimate.
What we deliver
Take over a Lovable, Bolt or Cursor project without starting from scratch.
“Vibe coding” tools have changed how products get launched. In a few days, an idea becomes a clickable application with screens, user accounts and a database. It is an excellent way to test a use case, win over early customers or clarify a need, and the code produced is often a perfectly usable foundation.
What these tools do not guarantee is what production requires: access rules that actually protect data, secrets that never leave the server, a versioned database schema, tests on critical journeys, reproducible deployment and code another developer can understand. Our job is to add these elements while keeping everything that already works.
Secure data and access
Exposed keys and secrets, Supabase or Firebase access rules, authentication, role-based permissions, server-side data validation, calls to third-party services. Security fixes come first.
Make it reliable and test it
Versioned database migrations, error handling, automated tests on the journeys that matter to your business, separate environments for development, acceptance testing and operations.
Deploy, host and hand over
Deployment pipeline, suitable hosting, monitoring, backups and documentation. You keep ownership of the code and an application that your team, or ours, can keep evolving.
Signs to look for
The warning signs of a vibe-coded app.
An AI-generated app can look finished while it has never faced real users. These situations show that a technical takeover is needed before opening access, or quickly if the app is already in use.
Every new request breaks something else
The tool fixes one screen and breaks another. Successive prompts have stacked up variants of the same logic, and nobody knows which one applies anymore.
You do not know who can read which data
Tables were created request after request, without checking access rules. A logged-in user can sometimes view or modify another user’s data.
Keys show up in the browser
A payment, email-sending or AI model API key is called from the front-end code. Anyone who inspects the page can retrieve it and use it.
The database was changed by hand
Columns added from the console, no change history, no tested backup. It is impossible to rebuild the environment or roll back.
The app depends on a single person or a single tool
It only exists in the tool’s workspace, or on the computer of the person who built it. The code is not in a repository you control.
What the takeover covers
Auditing AI-generated code, point by point.
Our diagnosis follows the order of risk. Flaws that expose data come before developer-comfort issues, and every finding leads to a concrete, estimated and prioritized fix.
Keys, secrets and third-party calls
Searching for keys in the front-end code and the repository history, separating public keys meant for the browser from service keys that must stay server-side, rotating exposed secrets, moving sensitive calls (payment, email, AI models) to server functions.
Supabase and Firebase access rules
Enabling and checking Supabase Row Level Security policies table by table, reviewing Firestore and Storage security rules on Firebase, tests that verify a user can only read their own data.
Authentication and permissions
Sign-up, email verification, password reset, session duration, roles and administration. Access controls are enforced by the server or the database, not only by the interface.
Database and migrations
Reading the schema, missing constraints and indexes, duplicated data. Setting up versioned migrations in the repository, test datasets and backups whose restoration has been verified.
Tests and code quality
Automated tests on critical journeys (sign-up, payment, creating and sharing data), dependency review, removal of dead code, consolidation of duplicated components and logic.
Performance and operations
Repeated queries, pages without pagination, oversized images and bundles, error handling, logs and alerts. The app must stay fast and readable as data and users grow.
When the app was generated in React or Next.js, which is common with these tools, we take it over with our React and Next.js teams, without changing technology if it suits the product.
From work to deliverables
How an AI-generated app takeover unfolds.
Recovery and diagnosis
Exporting the code to a repository you own, inventorying the services used (database, authentication, payment, email, hosting), reading the code and testing the journeys. You get a list of risks ranked by severity and a costed takeover plan.
Security fixes
Rotating exposed secrets, access rules, server-side checks. If the app is already open to the public, these fixes are delivered first, before any new feature.
Consolidating the foundation
Versioned migrations, separate environments, automated tests, restructuring of fragile parts of the code and documentation. Enhancements are delivered in stages and demonstrated.
Go-live and handover
Automated deployment, monitoring, backups, domain name and administrator accounts in your name. A documented handover lets your team take back control, or entrust us with what comes next.
What your team receives
- Security and code diagnosis, prioritized takeover plan
- Code in your repository, migrations, tests and deployment pipeline
- Architecture, operations and handover documentation
Delivery in practice
Web and mobile products we keep running in production.
Gorilla eSIM: evolving a web and mobile product
We evolve the traveler product in React and Flutter, and we built an affiliate platform for B2B partners from scratch.
A regulatory compliance SaaS platform
A platform in Java and React, developed by a team where developers and regulatory experts work together.
The choices that matter
Take over, restructure or rewrite?
An AI-generated app does not need to be rewritten on principle. In many cases, the interface, the journeys and part of the logic can be kept, and the effort focuses on security, the database, tests and deployment. The diagnosis separates what can be kept, what should be restructured and the rare parts that are better rebuilt, for example payment or permission logic that has become impossible to verify.
Choosing the hosting is part of the takeover. Staying on the hosting offered by the tool, moving to a front-end hosting platform or to your own cloud: the decision depends on your data constraints, your costs and how independent you need to be. We can handle this part through our DevOps and cloud management service.
If your app itself relies on an AI model, such as an assistant, an agent or document extraction, taking an AI POC to production adds what is specific to these uses: response quality evaluations, monitoring and tracking of model call costs. And if you only want an assessment before deciding, a technical audit can be carried out on its own.
How we work together
Start with a diagnosis.
Share access to the code and the database project, a demo of the main journeys and what your users expect. Our engineers carry out the diagnosis, overseen by our tech leads, then the takeover is run as a fixed-price project, with an identified point of contact, on a defined scope.
If the product is still at the idea stage, or if the prototype cannot be taken over, we can also build a custom MVP based on what your prototype taught you. For a prototype built around AI, see also our offer AI POC takeover, all the way to production. Once the app is live, our application maintenance services keep it secure and up to date.
Frequently asked questions
Your questions.
Can a Lovable app go to production?
Yes, provided you check what the tool generated. Code produced by Lovable, Bolt or v0 can serve as the foundation for an application in production. However, you need to check data access rules, authentication, secret management and the database, add tests and controlled deployment, then set up monitoring and backups.
Does everything need to be rewritten?
Rarely. The diagnosis shows what can be kept, what needs to be restructured and what is better rebuilt. A full rewrite is only justified if the code has become impossible to evolve or verify, and we tell you so, with the reasons and the effort involved.
Is my Supabase app secure?
That depends on its Row Level Security policies. The Supabase public key is designed to be used in the browser, but it protects nothing if tables do not have suitable access rules. We check every table, test that a user can only read or modify what belongs to them and make sure the service key is never exposed client-side. The same work applies to Firebase security rules.
Who owns the application’s code?
You do. The first step of the takeover is to place the code in a repository you own and to put the database, hosting and domain name accounts in your name. The code we write afterwards also belongs to you, with the documentation needed to take it over.
Can we keep using Lovable, Bolt or Cursor after the takeover?
Yes, these tools remain useful for prototyping new screens or speeding up development. We simply recommend that changes go through the repository, tests and code review before reaching production, so the problems that were fixed are not reintroduced.
How long does it take to take over an AI-generated app?
It depends on the size of the app, the state of its database, the number of connected services and whether it is already in use. The initial diagnosis makes it possible to cost a step-by-step takeover plan, starting with security fixes.
Your app works. Let’s make it reliable.
Show us your app, the tool that generated it and what you expect from its production release. We will tell you what needs to be taken over to open it to your users with confidence.