There’s a workflow almost everyone lands on: build the first version fast in Lovable or Bolt, get something that works, then — once it looks finished — point real users at it. The prototype was the easy part. The gap between “it works on my screen” and “strangers are putting their data in it” is where vibe-coded apps quietly break.
That gap is real, and it’s not your fault. The tools are built to get you to a working demo as quickly as possible. Working and ready for production are two different jobs, and almost nothing in the build flow tells you when you’ve crossed from one to the other.
Prototyping optimises for “it works.” Production is a different game.
A prototype has one job: prove the idea, for one friendly user (you), on the happy path. Every default that gets you there fast — an open database “just to get it working”, a key dropped straight into the code, a route protected only by hiding the link — is a reasonable shortcut while you’re the only person touching it.
Production flips every one of those defaults into a liability. Now there are people who aren’t you, some of them poking at things on purpose, all of them trusting you with data. The same app, unchanged, is now exposed to questions it was never built to answer.
What actually changes when real users show up
- Security stops being theoretical. A secret in the client bundle was invisible while you were the only visitor. The moment the URL is public, anyone can open DevTools and read it.
- Data isolation starts to matter. With one user, there’s no such thing as “another tenant’s data”. With a hundred, one missing server-side check means customers can read each other’s records.
- The database is suddenly reachable. Row-level security that’s off was harmless when you were the only account. Now your public anon key is a door into every table.
- Scale becomes a real number. A query that’s instant on ten rows can be dead at a thousand users — and launch day is exactly when everyone arrives at once.
- Cost becomes an attack surface. An endpoint with no rate limit is fine until someone finds it and runs your bill into four figures overnight.
None of these show up while you’re testing. Every checkmark stays green. They only appear when someone who isn’t you interacts with the app — which, by definition, is after you launch.
The step most people skip at the handoff
In the old way of building, there was always a moment between “looks done” and “shipped”: someone senior read the code first. Vibe coding compressed the build from weeks to an afternoon and, almost by accident, dropped that one step.
You don’t need to put it back by slowing down — you need it exactly once, at the handoff. Before you graduate a prototype to production, the highest-leverage thing you can do is have someone read the actual code with an adversary’s eye and tell you, plainly, what breaks when real users arrive. Run the free 2-minute self-check to see where you stand, work through the pre-launch checklist, and if any of it makes you unsure, that’s the signal.
That’s exactly what a production-readiness audit is for: a senior engineer reads the code your AI wrote — not a scanner, not the same model that built it — and tells you, in plain English, what to harden before you point real users and real data at your Lovable or Bolt app. The prototype got you here fast. This is the one read worth getting before the launch.