AI coding tools have quietly changed who gets to build software. With tools like Claude, Cursor and GitHub Copilot, a founder, an operations manager or an analyst can describe what they want and watch a working application take shape in days. It even has a name now: vibecoding.
A lot of what gets built this way is genuinely good. We’ve seen internal tools, customer portals and workflow apps that solve real problems and would have cost tens of thousands to commission a few years ago.
The trouble starts when the business begins to depend on it.
The gap between “it works” and “we can rely on it”
A typical vibecoded app looks something like this. The code lives in a folder on one person’s laptop, or perhaps a free hosting tier signed up with a personal email address. API keys are pasted straight into the code. There’s no version control, so last Tuesday’s working version is gone forever. Nobody has reviewed it for security. There are no backups, no monitoring, and the only person who understands it is the person who prompted it into existence.
None of that matters for a prototype. All of it matters for a system your team uses every day. A few simple questions expose the gap:
- What happens when it breaks at 9am on a Monday? Who gets the call, and what do they actually do?
- Where is the customer data, and who can reach it? Hard-coded credentials and missing access controls are the norm in AI-generated prototypes, not the exception.
- Can anyone else change it safely? Without version control, testing and a release process, every change is a gamble on the live system.
- What happens if the person who built it leaves?
If you can’t answer those, you don’t have a business system yet. You have a very impressive demo.
What “production-ready” actually means
The good news is that closing the gap rarely means starting again. Most vibecoded applications need hardening, not rewriting. In practice, getting to production means putting a handful of engineering foundations in place.
A proper repository, with security built in
The code moves into a professionally structured Git repository with branch protection, code review and dependency scanning. Secrets such as API keys, passwords and connection strings come out of the code and into a proper secrets store. The codebase becomes an asset the business owns, not something that lives on one machine.
The right platform, chosen honestly
Not every app needs a sprawling cloud estate. Some belong on Azure or AWS with proper networking and identity, while others are happiest on a simpler managed platform for a fraction of the cost. The right answer depends on the application’s compute, data, compliance and integration needs, which is why platform selection should be led by the workload rather than by whatever a supplier finds easiest to sell.
Release management and continuous integration
This is the piece that lets you keep vibecoding safely. A CI/CD pipeline runs automated tests and security checks on every change, then releases through development, staging and production in small, reversible steps. You keep the speed of AI-assisted development and lose the 2am surprises.
Hardening for real users
Authentication and access control, input validation, error handling, logging, backups and recovery testing. It’s the unglamorous engineering that separates a demo from a service, and for UK businesses it’s also where Cyber Essentials and UK GDPR obligations get addressed properly rather than hoped about.
A support wrap
Finally, someone has to run the thing. Monitoring with real engineers behind it, security patching, dependency updates and an agreed response when something goes wrong. Any production system deserves that discipline, whether it was written by a development team or prompted into existence over a weekend.
Keep the speed, lose the risk
The point of all this isn’t to slow vibecoding down. It’s the opposite. Once the foundations are in place, AI-assisted development gets safer and faster: every change flows through the same tested, reviewed release process, so you can keep iterating with AI tools while the business runs on a platform that’s monitored, patched and backed up.
That’s the thinking behind our new Vibecode to Production service. We start with a fixed-scope production readiness review of what you’ve built, tell you honestly what’s solid and what’s risky, then take it through secure repository setup, platform selection, CI/CD and hardening, with a 24×7 support wrap from UK engineers once it’s live. Most engagements go from review to a live, supported service in four to eight weeks.
Built something you’re almost ready to rely on?
You’ve done the hard part. You’ve built something your business actually wants to use. If you’d like an honest, plain-English view of what it would take to run it in production, get in touch and we’ll take a look.
