Vibe coding
What it costs to finish a vibe-coded app in 2026 (real ranges, and the arithmetic behind them)
AI Cubed
September 9, 2026
9 min
Ask three developers what it costs to finish your AI-built app and you'll get three numbers that differ by a factor of five. That's not because two of them are lying. It's because "finish" is undefined until someone has looked at the code, and because rates vary enormously. This guide gives you the arithmetic so you can sanity-check any quote you receive — including ours.
We don't publish a single price here because we quote fixed scope after a two-business-day audit, and a number without the audit would be a guess. What we can publish is how the number is built, which is more useful than a price tag anyway.
The effort side: what actually has to be done
Our itemised guide to the last 20% lists fourteen items. Here they are again with effort in engineer-days, for a typical single-tenant web app with a database and a few third-party APIs, done by someone who has done them before.
| Item | Low | High | Notes |
|---|---|---|---|
| Secrets out of repo/browser, rotated | 1 | 2 | Includes purging git history if needed |
| Paid APIs moved server-side | 1 | 3 | More if many integrations |
| Database access rules (RLS) | 2 | 4 | Per-table policies, tested with two users |
| Auth on real domain, phones, refresh, reset | 1 | 3 | Mostly configuration; testing takes the time |
| Separate environments | 1 | 2 | |
| Payments in live mode, webhooks, refund | 1 | 3 | Only if you charge |
| Schema as migrations, reconciled | 1 | 3 | Worse if the dashboard has drifted far |
| Error handling and failure states | 2 | 5 | Scales with number of screens |
| Tests on the money paths | 2 | 5 | Sign-up, checkout, core action |
| Deploy from repo, with rollback | 1 | 2 | |
| Monitoring and alerts | 0.5 | 1 | |
| Backups, tested | 0.5 | 1 | |
| Performance on real data | 1 | 4 | Indexes, pagination, query fixes |
| Legal pages and account ownership | 0.5 | 1 | |
| Total | ≈ 16 | ≈ 39 | Typical rescue lands at 10–20 days once items that don't apply are removed |
A real app rarely needs every item at the high end, and several may not apply. In practice most rescues we scope land between ten and twenty engineer-days. Add the features that never quite worked on top of that.
The rate side: what you'll actually be quoted
| Who | Typical hourly range | What you get | Watch for |
|---|---|---|---|
| Offshore freelancer | $25–75 | Capable execution on a clear spec | You are the spec and the QA; security items are frequently skipped |
| US/EU freelancer | $75–150 | Experienced generalist | Availability; single point of failure; ownership of accounts |
| Small agency / studio | $120–250 | A team, process, accountability | Who actually does the work; hand-offs after the sales call |
| Large agency | $200–400+ | Scale and process | Minimum engagement sizes; junior staffing |
| Vibe-coding-rescue specialists | Usually fixed scope | The specific checklist, done before | Whether the audit is real or a sales call |
These are market observations, not quotes, and they move. The point is the multiplication: fifteen engineer-days is 120 hours. At $60/hour that's about $7,000; at $150/hour about $18,000; at $250/hour about $30,000. Same work, very different numbers — and very different odds that the security items actually get done.
The four things that move the number most
- Has the core flow ever worked end to end for a real user? If yes, the work is additive and predictable. If no, there's discovery inside the estimate, and the range widens.
- How much security has to be corrected? Missing RLS on three tables is a day. A client-side architecture that leaks by design is a rewrite of the data layer.
- Are payments involved? Live-mode verification, webhooks, refunds and reconciliation add days and require real transactions.
- Who owns the accounts? If hosting, database and domain are in someone else's name, migration adds time — and it's non-negotiable.
Fix versus rebuild: the cost logic
A rebuild replaces the fourteen-item list with "build it properly from scratch," which for a typical MVP is four to eight weeks. That's more than a rescue — unless the rescue involves understanding a codebase nobody can read, in which case the understanding costs more than the writing. The five-signal test in our fix-or-rebuild framework tells you which side you're on. Rebuilds are also consistently underestimated, because the original requirements are scattered across the old code; insist on a phased plan with a working first version early.
How to get a quote you can trust
- Pay for an audit first. A fixed-price, two-day audit that produces a written report and a fixed quote is worth more than any free estimate, because the estimate is guessing.
- Ask for the checklist. If they can't show you the list of items the quote covers, the quote covers whatever is convenient later.
- Ask who does the work and whether they were on the call.
- Ask whose name the accounts will be in. The only acceptable answer is yours.
- Prefer fixed scope. An hourly meter with no checklist is how a two-week rescue becomes a four-month relationship.
What AI Cubed does about this
We quote fixed scope after a two-business-day, fixed-price audit that produces the itemised list above with your numbers in it. If a rebuild is cheaper we say so on day two. See vibe-coding rescue.
Frequently asked questions
Related
Start here
See where your operation is losing time.
Twenty minutes with an operator, not a salesperson. We'll name the one bottleneck costing you the most — and tell you whether it's worth fixing with software at all.
Book your free 20-minute consult→20 minutes · video call · no preparation needed