You built your MVP in a few weekends with Lovable, Cursor, Bolt or Claude. Users signed up. Maybe some are paying. Now every new feature takes longer than the last one, and you have a quiet feeling that something underneath is fragile.
That feeling is usually right. When Veracode tested code from over 100 AI models, 45% of the samples introduced OWASP Top 10 security flaws. Our team reviews vibe coded apps every week, and the problems show up in a predictable order. Here are the five signs we look for first, with a quick check you can run yourself tonight.
1. You don't know who can read your database
Most vibe coded apps run on Supabase or Firebase, and the AI rarely sets up access rules properly. In 2025, a disclosed vulnerability in Lovable projects, CVE-2025-48757, showed how missing row level security let outsiders read user emails, API keys and payment records straight from the database.
Check tonight: Open the Supabase dashboard and confirm row level security is on for every table. Then read Supabase's guide on securing your API and compare it to your setup.
2. Every fix creates a new bug
You ask the AI to fix one thing and two others break. You are not alone. In the 2025 Stack Overflow Developer Survey, 66% of developers named "AI solutions that are almost right, but not quite" as their top frustration, and 45% said debugging AI code takes longer.
Check tonight: Count your last ten AI assisted changes. If more than three needed a follow up fix, the codebase has no stable foundation to build on.
3. The same logic lives in several places
AI tools copy code instead of reusing it. GitClear analyzed 211 million changed lines and found copy and pasted code rose from 8.3% to 12.3% of changes between 2021 and 2024, while refactoring fell from 25% to under 10%. In a vibe coded MVP, this means your pricing rule or email logic might exist in four versions that disagree.
Check tonight: Search your codebase for one business rule, like a price or a discount. If it appears in more than one file, you have drift.
4. Your users are your test suite
If customers find bugs before you do, you have no tests that matter. Many AI generated tests only check that the page loads.
Check tonight: Break your checkout or signup on purpose in a local copy. If no test fails, nothing is protecting your revenue path.
5. You can't roll back a bad release
Many vibe coded apps deploy straight from the builder to production. There is no staging environment and no way to undo a broken release quickly.
Check tonight: Ask yourself how long it would take to restore yesterday's version if today's deploy broke logins. If the answer is "I don't know," fix this first.
What to do if three or more apply
Don't just start over. Most MVPs we workon can be repaired in place, and a rewrite throws away the product decisions you already validated with users. Work in this order -
lock database access and secrets
add planned tests on signup and payment paths,
set up a staging envs with rollback,
then clean up the duplicated/broken logic.
You can do much of this yourself with the same AI tools, as long as you give them written rules and review every change. If you'd rather have help, a focused vibe coding audit followed by cleanup can usually be done in a few weeks.
Curious what others here have hit. If you vibe coded your MVP, which of these showed up first for you?
Top comments (0)