From AI prototype to a product customers can trust
Building a prototype in Lovable, Bolt or Replit is quick. If the idea takes off, customers soon start using it with their own data. From then on the app has to do more than just work: those customers' data needs to be properly protected, and someone has to keep the app up to date.
How secure are vibe-coded apps?
In vibe coding, someone describes in plain language what the app should do and an AI tool writes the code. Whether an outsider can get at customers’ data does not show in the app itself, which simply does what it was asked to do.
A scan by Reeve of apps that are already live shows that such apps mostly pass the ordinary checks, but that the serious failures sit in the database. In 57% of the apps with a Supabase database that Reeve could check, an outsider could read at least one table of data without a password. A leaked master key to the database, which opens up all of the data, turned up in only three apps.
ENISA, the EU agency for cybersecurity, puts it plainly in a draft of its technical advisory on AI-assisted software development: “functional correctness should not be confused with security”.
Maintenance starts with the first customer
An app with real users needs ordinary, ongoing work: setting up logins and permissions properly, fixing the bugs customers report, and updating the components the app runs on whenever a security update comes out. There are more and more of those updates, now that open-source projects are getting far more security reports, partly because of AI.
Large organisations will feel it too: according to Tray.ai, Gartner expects in a June 2026 report that by 2028, 30% of software engineering teams will feel a real strain on their capacity from vibe-coded apps built by colleagues outside IT.
When should maintenance be in place?
The best moment is before the first incident, not when a customer reports seeing someone else’s data. A clear sign that the time has come: nobody in the company knows exactly how the code fits together, because an AI tool wrote it. Whoever then has to fix a bug or apply an update first has to work out how everything connects, which is far easier now than later, with a customer waiting for a fix.
Who can take the app further?
The work needs to sit with someone who is responsible for it and has the time to do it. Which route fits depends on what the company already has.
The in-house team
A company with developers of its own can hand the work to them, as long as time for it is genuinely set aside alongside new features.
A freelancer
A freelancer suits a clearly scoped job, such as a security review or setting up logins and permissions properly. It should be settled up front, though, who looks after the app once that job is done.
An agency
An agency can improve or rebuild the app as a project. The work that follows falls outside such a project unless the agency explicitly takes on the maintenance as well.
A dedicated developer
If the product keeps growing, with ongoing work on new features and maintenance, a dedicated developer fits: someone who works only on this product and gets to know it well as a result.
Through Backstage IT, a company can work with a dedicated developer, even without a development team of its own. The developer gets to know the prototype’s code, builds it out into a product and keeps it up to date, security updates included. The developer checks whatever AI tools produce. The company stays in charge of the work and can start with one developer.
In a half-hour call, with no obligation, we look at how your app is built today and which route suits you.
