Article
Vibe-Coded MVP Production Hardening
Speed got you a preview. Strangers, cards and data need a human gate. Here is the Alphesda path from ranked audit to harden or rewrite.
If you built with Cursor, Claude Code, Codex, Copilot, Lovable or Bolt, you already know the feeling: each commit looked fine until the whole system was subtly wrong. Rescue write-ups describe stub integrations marked MVP complete, auth that does not scope queries, Stripe happy paths without webhook trust, and agents that invent parallel files instead of editing the system you already have.
Some teams also learn the hard way that unreviewed agent pushes and infra commands do not belong on production. Public postmortems exist for agent-driven deploy and infrastructure mistakes. Use them as process warnings, not as entertainment. SaaStr published one after Replit Agent deleted a production database during a code freeze. That is a public incident, not an Alphesda client.
This page is the SaaS and internal-tool companion to the $200 + GST vibe coding audit. For trades, clinics, hospitality and Shopify, start at when your AI build needs a professional. For why demos fail the production test, keep why vibe-coded apps are not production ready open beside this.
What we mean by production-ready
Not a certificate. Not legal advice. Practical readiness:
- Auth that authorises, not only authenticates
- Secrets out of the client bundle and the git history
- Payments with verified webhooks and idempotency
- No decorative access control
- Hosting you own, with backups that restore
- A codebase a second human can change without asking the model first
That list matches the seven surfaces on our Standard Vibe Coding Audit ($200 + GST for one eligible app).
Stripe that charges and forgets
Checkout that trusts the browser to set a paid flag will lie. The common public pattern is quieter: checkout succeeds, the card is charged, and the app never updates access because the webhook lifecycle was never wired. Cursor-built SaaS products have also returned 200 on invoice.payment_failed without revoking access. After a Bolt export, the preview URL cannot receive Stripe webhooks, and signing secrets never land on a real host. Verify signatures on the raw body, make fulfilment idempotent, and handle cancel, failed and past-due. Our Stripe guide is the longer commercial map.
Agentic handoff (process)
Speed without a gate multiplies debt. Before you hire anyone, freeze a version: export the repo, stop parallel prompt churn on the same branch, and record the one customer journey that must work. Our finish guide explains that handover. Treat production data as out of bounds for an unsupervised agent.
Salvage versus rewrite
Useful UI can stay. Stubbed billing, broken tenancy and unowned generated files often should not. Rescue shops publicly describe treating weak codebases as a requirements document. We make that call in the report, with an itemised quote. You approve before we touch production.
After the audit
Hardening, feature completion, CRM wiring and deployment are separate stages. App development Melbourne and custom software cover follow-on build. AI automation comes after the product is honest. We do not ship unsupervised agents on half-finished auth. Org-wide email and DNS cyber work sits on cyber security audit Melbourne, which is a different product from the app-layer vibe audit.
Vibe-coded MVP hardening FAQs
Does $200 include fixing the app?
No. It covers the ranked written report and a rescue quote for one eligible app. Fixes are approved item by item.
We only have a hosted preview.
Discovery still helps. The standard $200 price expects source and hosting access. Preview-only is quoted separately.
Is this a penetration test?
No. It is a production-readiness review of configuration, code, privacy flows and debt.
Checkout worked. Why is the buyer still on the free plan?
The charge is not the product. If fulfilment waits on a thank-you page or a client flag, a closed tab or a failed invoice leaves access wrong. Wire signed webhooks, including invoice.payment_failed, on a host Stripe can reach.
Ready to harden the MVP?
Book the $200 audit or start with a Discovery Session. Call 0481 347 115 or 03 7073 2727. connect@alphesda.com.