Is My Vibe-Coded App Production Ready?

Most vibe-coded apps are not production-ready yet. The AI did the fast part. Now comes the boring but critical part: secrets management, error handling, auth enforcement, and observability. Use this checklist to assess whether your app is ready for real users, or whether gaps remain. Be honest with yourself.

Auth & Permissions

Are your auth and API permissions actually enforced? Authentication and role-based access control are the most common failure point in AI-generated code. The app works fine when you're the only user. It breaks catastrophically when a second user can see everyone else's data.

What you need: Every API endpoint must verify that the logged-in user is allowed to access that specific record. Not just "are you logged in?" but "are you logged in AND is this your record?" This is called row-level security (RLS) or fine-grained authorization.

What Vibe platforms typically miss: The code generator builds login forms and session storage. It almost never implements backend authorization checks. You'll see requests go to the server, but the server trusts the client to ask for the right data. That's the vulnerability.

How to verify: Pick three API endpoints that return user data. Make a request for data that belongs to a different user. If you get it back, you have a critical bug. Check your database schema: do you have a user_id field on every table that needs it? Check your backend code: does every SELECT query include a WHERE clause that filters by the current user's ID?

Example failure: A vibe-coded invoice app where one customer can see every other customer's invoices by guessing invoice IDs in the URL. No auth check on the backend.

What to do: Add explicit authorization logic on the server side. Frameworks like Next.js, Rails, and Django have middleware for this. If you're using Supabase or Firebase, enable Row-Level Security in the database itself--it's often cheaper and more reliable than app-level checks. The rule is simple: before returning any user data, verify the request came from the user who owns it. For a guided walkthrough, see Opsily's vibe coding hosting guide, which covers auth patterns used in production Vibe apps.

Tools that help: Supabase (built-in RLS), Firebase Security Rules, or a managed platform like Opsily's Ship, which includes database access controls.

Why it matters for production: A single authorization bypass can leak customer data, trigger GDPR fines, and end your business. This is not optional.

Secrets & Environment Variables

Are your API keys and credentials actually safe, or buried in source code? Hardcoded secrets in source code are the second most common failure. You paste an API key into a.js file, commit it to GitHub, and by next week a bot is using it to rack up charges on your AWS bill.

What you need: Every credential--database password, API key, OAuth secret, Stripe key--must live outside the code. Environment variables are the standard. In production, secrets should never touch your git history.

What Vibe platforms typically miss: The AI generates code that "just works" locally. To make it work, it often embeds secrets or asks you to paste them into the code. No mention of.env files. No rotation strategy. No audit trail.

How to verify: Run git log -p -S "key" | grep -i secret (or use truffleHog, a secret scanner). If you find API keys, database passwords, or tokens, you have a leak. Check your.gitignore: does it include.env? Check your deployment platform: are you injecting secrets as environment variables, or uploading a config file?

Example failure: A vibe-coded SaaS app with a hardcoded Stripe key in a JavaScript file. An attacker clones the repo, extracts the key, and processes fake charges.

What to do: Use a secrets manager. Options range from simple (GitHub Secrets for CI/CD, Vercel Secrets if you're on that platform) to robust (AWS Secrets Manager, HashiCorp Vault). For self-hosted apps, Opsily's Ship platform handles secret injection at deploy time. Never paste credentials into code.

1. Create a.env.example file with placeholder keys.
2. Add.env to.gitignore.
3. Set secrets in your deployment platform's UI.
4. Update your local README: "Copy.env.example to.env and fill in your keys."

Tools: git-secrets (pre-commit hook), truffleHog (scans git history), or built-in secret management in Vercel, Railway, Render, Northflank, or Ship.

Why it matters: Leaked secrets can cost thousands in fraudulent API usage and pose legal liability for exposed customer data.

Error Handling & Resilience

Do your errors fail gracefully or silently? Silent failures are insidious. The app returns a blank screen, a user refreshes, gives up, and you never know what went wrong.

What you need: Every async operation (API calls, database queries, file uploads) must have error handling. Timeouts, network failures, rate limiting, and invalid inputs should all trigger clear error messages. The user should never see a blank screen or JavaScript console error.

What Vibe platforms typically miss: The generated code often omits try/catch blocks or leaves them empty. It assumes the happy path. If the API call times out, the app hangs or crashes silently.

How to verify: Run your app offline (disconnect your network). Try basic operations: submit a form, load data, upload a file. Do you see a spinner that times out? A clear error message? Or does the page freeze? Check your browser console for uncaught errors. Better: use your browser's DevTools to throttle your connection (simulate slow 3G) and repeat the test.

Example failure: A vibe-coded booking app where the calendar load has no timeout. If the database is slow, the calendar never loads, and the user assumes the app is broken.

What to do: Wrap all async operations in try/catch or.catch() handlers. Set timeouts (5-10 seconds, depending on the operation). Return user-friendly error messages. Log errors server-side so you can debug later.

1. Every API call: set a timeout, catch errors, show a message.
2. Every database query: same.
3. Forms: validate client-side (fast feedback) and server-side (security).
4. Uploads: check file size before sending.

Tools: SWR or React Query for data fetching (handles retries and errors), Sentry for error tracking and alerting, or a managed platform like Ship that includes error monitoring.

Why it matters: Users won't stick around for a broken app. Errors you can't see are errors you can't fix.

Data Integrity & Backups

Can you recover from data loss, or will a single bug wipe out your database? Most Vibe-coded apps skip backups entirely. The database might run on a managed platform (Supabase, Firebase, etc.) that handles automatic backups. But you need to verify it, and you need a restore test.

What you need: Automated daily backups, kept for at least 30 days. A documented restore process. A test of the restore process (to prove it actually works).

What Vibe platforms typically miss: The AI focuses on the app, not the infrastructure. Your data layer might be Supabase or Firebase, which do backup, but you won't know unless you read the docs.

How to verify: Log into your database provider's console. Supabase: go to Settings > Backups. Firebase: navigate to Firestore backup settings. Check that backups are enabled and automatic. Set a calendar reminder to test a restore once per quarter.

Example failure: A vibe-coded service deletes all customer data due to a bug. The startup assumes backups exist. They don't, because backups weren't enabled. Data is gone forever.

What to do: If you're using Supabase, enable automatic backups (it's one toggle). If you're self-hosting a database (PostgreSQL, MySQL), set up automated daily dumps to object storage (S3, Backblaze, etc.). If you use a managed platform like Ship, backups are included.

Checklist:

1. Verify backups are enabled in your database settings.
2. Check the retention period (30 days minimum).
3. Test a restore in a staging environment once per quarter.
4. Document the restore steps so a tired human can execute it at 3am.

Why it matters: Lost data is unrecoverable heartbreak. Backups are cheap insurance.

Observability & Monitoring

Can you see what's happening in production, or are you flying blind? Observability means you can answer: "Is the app up? Are users getting errors? Is the database slow?" without asking your users for screenshots.

What you need: Uptime monitoring (Ping every 5 minutes, alert if down). Error tracking (Sentry, Rollbar, or similar). Optionally: database performance monitoring, user session replay (LogRocket).

What Vibe platforms typically miss: The generated code has no instrumentation. No error logging. No performance metrics. You deploy and you're flying blind.

How to verify: Open your Sentry (or error tracker) dashboard. Is it empty? If so, either you have zero errors (unlikely) or errors aren't being captured. Check your deployment logs: are errors showing up anywhere? Set up a simple uptime monitor (UptimeRobot is free for one check). If your app goes down, do you get a notification, or do your users tell you?

Example failure: A vibe-coded app experiences a database connection pool exhaustion. Users see 500 errors for two hours. The founder finds out from Twitter, not from monitoring.

What to do: Set up error tracking (Sentry has a free tier). Set up uptime monitoring (UptimeRobot, Betterstack, or Grafana). For logging, ship errors to a log aggregator or include them in Sentry. If self-hosting, use a platform like Ship that includes observability.

1. Sentry or similar: errors, performance, crashes (Free tier: 5k events/month).
2. UptimeRobot or Betterstack: ping your app every 5 minutes, alert if down.
3. Dashboard: check your status once a week. Seriously.

Tools: Sentry (errors), DataDog (comprehensive), New Relic (expensive but thorough), or Opsily's Ship (included in hosting).

Why it matters: You can't fix what you don't see. Observability is how you sleep at night.

Testing & CI/CD

Are your changes tested before shipping, or do you deploy and pray? Every time you deploy a change, something can break. Testing and continuous integration catch breakage before users see it.

What you need: Automated tests for critical user flows (login, creating a post, paying an invoice--whatever your core feature is). A CI/CD pipeline that runs tests on every push and blocks broken code from deploying.

What Vibe platforms typically miss: The generated code has no tests. The build process is manual. You deploy by clicking a button or pushing to a branch. No safety net.

How to verify: Check your repo: does it have a test file? Run your test suite locally. Does it pass? Set up GitHub Actions (or similar) to run tests automatically on every commit.

Example failure: You deploy a change that breaks login. Users can't access the app. You rollback manually, panic-debugging your way to a fix. This was preventable.

What to do: Write tests for critical paths. Aim for 20-30 tests covering the most important features. Use a framework like Vitest (JavaScript), PyTest (Python), or Jest. Set up CI/CD to run tests automatically. When you use a managed hosting platform, you get preview deployments for free--deploy each change to a staging URL for QA before pushing to production. See how to deploy with CI/CD for specific setup steps.

1. Create a tests/ folder.
2. Write E2E tests for: login -> action -> success.
3. Push to GitHub/GitLab. Set up Actions to run tests.
4. Block merges if tests fail.

Tools: Playwright or Cypress (E2E testing), GitHub Actions or GitLab CI (free), or managed platforms like Opsily's Ship which include preview environments.

Why it matters: Tests are your insurance against shipping bugs to production.

Rate Limiting & Scaling

Can your app handle sudden traffic, or will it melt when you get that HackerNews post? If your app goes viral or gets hit by a bot, can it survive the load?

What you need: Rate limiting on your APIs (limit requests per user per time period). Database query optimization (if a popular feature triggers a slow query, it cascades). Horizontal scalability (your app should handle 10x traffic without melting).

What Vibe platforms typically miss: The generated code doesn't include rate limiting. The database queries aren't optimized. Scaling strategy is: "hope we don't get traffic" or "we'll deal with it when it happens."

How to verify: Load test your app. Use a tool like Apache JMeter or Locust to simulate 100 concurrent users. Does it stay responsive? Check your database query logs: are any queries taking longer than 1 second? Check your API responses: do you see rate-limit headers?

Example failure: A vibe-coded app gets featured on HackerNews. 10k people visit in an hour. The database gets crushed. The app goes down. Recovery takes hours.

What to do: Add rate limiting to your APIs. Most frameworks make this easy. For a managed solution, platforms like Ship handle this automatically.

1. Rate limiting: 100 requests per user per minute (adjust based on your use case).
2. Database: add indexes to frequently queried fields.
3. Caching: cache expensive operations (Redis or similar).
4. Scaling: use a platform that auto-scales (Vercel, Railway, Render, or Opsily's Ship).

Tools: Redis (caching/rate limiting), Vercel (auto-scaling), Render (managed), Railway (managed), or Ship (managed with observability).

Why it matters: Scaling failures are expensive and embarrassing. Plan ahead.

Frequently Asked Questions

Does Apple approve vibe-coded apps?

Apple's App Store doesn't explicitly block AI-generated code, but your app must meet App Store guidelines regardless of how it was built. Quality, functionality, and safety matter. If your app crashes, Apple will reject it. If it collects data without clear consent, Apple will reject it. A vibe-coded app can pass App Store review if it's production-ready by the criteria above. The rejection reason won't be "it was AI-generated"; it'll be "it crashes" or "it doesn't follow our privacy guidelines."

What are the downsides of vibe coding?

Speed is the only real advantage. The downsides: unfamiliar code patterns (hard to debug), no architectural planning (tech debt accumulates), missing infrastructure (no monitoring, backups, or CI/CD), vendor lock-in (tied to the tool you used to generate it), and unpredictable scaling (optimization happens after problems). A vibe-coded app scales fine for the first 1,000 users. Beyond that, expect trouble.

Can I use vibe-coded apps commercially?

Yes. There's no legal restriction on monetizing a vibe-coded app. You're responsible for all the same things as any other app: security, privacy, uptime, and customer support. The fact that AI wrote it doesn't shield you from liability.

Should I rewrite my vibe-coded app?

Not necessarily. If the app is stable, well-tested, and meets your production-readiness checklist, running it as-is is fine. Rewriting is expensive and risky. But if you're hitting scaling problems or critical security gaps, rewriting in a well-architected codebase (with a team that understands it) might be justified.

How do I choose between self-hosting and managed hosting?

Self-hosting (Hetzner plus Coolify) wins on price: typically 5-20 dollars per month for compute. Managed hosting (Northflank, Railway, Render, or Opsily's Ship) wins on risk reduction: automated backups, observability, zero-downtime deploys, and automatic scaling. Pick managed hosting if you value your time and sleep. Pick self-hosting if you want to minimize costs and can tolerate operational overhead.

What tools help me assess production readiness?

The tools mentioned above (Sentry, UptimeRobot, truffleHog, Playwright, GitHub Actions) each solve one part. But if you want a single platform that handles secrets, observability, backups, CI/CD, and staging deployments in one place, look at managed hosting options like Opsily's Ship. Self-hosting with Coolify or Caprover works too, but requires more manual configuration.

Is vibe coding only for prototypes?

No. Vibe coding can go to production if you apply the criteria in this checklist: auth, secrets, error handling, backups, monitoring, testing, and rate limiting. The question isn't "is vibe coding viable for production?" It's "did the AI generate production-grade code, or just a prototype?" Most of the time, it's a prototype that requires hardening.

How do I get a compliance audit for my vibe-coded app?

If your app handles customer data or payment info, you need to verify GDPR compliance (EU), CCPA compliance (California), or PCI-DSS compliance (if you take payments). A vibe-coded app is vulnerable to data leaks because of missing auth. Opsily's GDPR-compliant app hosting guide walks through the specific database and logging configurations required for regulatory compliance.

The Bottom Line

Most vibe-coded apps are not production-ready on day one. The AI handles the happy path. You handle the sad path: errors, security, monitoring, and failure recovery. Use this checklist to assess where you stand. Be honest about gaps. Then decide: invest time to harden it yourself (using the tools and techniques above), or switch to managed hosting to outsource the infrastructure.

If you're skipping the hard work, be prepared for silent failures, security breaches, data loss, and sleepless nights. If you're investing the time, you have a real product. Ship it.

Ready to move forward? Check out Opsily's Ship hosting platform to see how managed hosting can reduce your infrastructure risk.