Vibe-coded apps from Bolt, Lovable, Cursor, and similar tools ship fast but fail fast in production. The six gaps are predictable. Closing them before launch separates successful products from support nightmares.
Gap 1: No Auth/Authz Hardening
Prototype auth is often "anyone with the link." Production requires proper JWT validation, role-based access, session management, and rate limiting per user. Add OAuth2 or Cognito before any real user data touches the system.
Gap 2: Exposed API Keys in Frontend
Environment variables leak into bundled JS. Scan for process.env or import.meta.env containing secrets. Move all keys to server-side or use short-lived signed URLs. Rotate immediately if exposed.
Gap 3: No Error Handling or Retry Logic
Happy-path code assumes every call succeeds. Wrap every external call in try/catch with exponential backoff. Return user-friendly messages. Log full stack traces server-side. Unhandled promise rejections are the #1 cause of white-screen crashes.
Gap 4: No Observability
No logs, no metrics, no traces. Add structured logging (pino, winston), request IDs, and distributed tracing (OpenTelemetry). Without visibility, every incident is a mystery.
Gap 5: DB Queries Without Indexes
Prototype queries scan entire tables. Add composite indexes for common filters and joins. Monitor slow query logs. A missing index turns a 10ms query into a 30-second timeout under load.
Gap 6: No Rate Limiting
Public endpoints accept unlimited requests. Implement per-IP and per-user rate limits (100 req/min baseline). Use Redis or API Gateway throttling. DDoS protection is table stakes.
Internal links: see productionize AI prototype to production and aws cloud infrastructure consultant.
FAQ
How long does it take to harden a vibe-coded app?
2-4 weeks for a focused engagement. Most time is spent on auth, observability, and database indexing.
Can we keep using the AI tool after hardening?
Yes. Use it for new features, but route all production changes through code review and automated tests.
What is the biggest hidden cost?
Support tickets and lost customers from outages. One production incident often costs more than the entire hardening effort.
Do these gaps apply to internal tools too?
Yes, though the blast radius is smaller. Internal tools still need auth, logging, and rate limiting to prevent accidental data leaks.
Is there a checklist we can run before launch?
Yes. Auth review, secret scan, error path coverage, logging audit, query plan review, and rate limit test. We provide this as a pre-launch gate.
Have a project that needs this? Talk to Rutagon or call 907-841-8407.
Related: start up cloud architecture patterns, ai data extraction pdf automation.