How long does the last 20% of a vibe-coded app really take?

Two to four weeks for a typical single-tenant web app with an experienced engineer, longer if payments, compliance or a large data model are involved. The four launch-blocking items — secrets, server-side keys, database rules, auth — usually take the first week.

Why doesn't the AI just do these things?

Nothing in a prompt or a preview exercises them. The tool builds what can be seen and clicked in the environment it runs in; production properties — a real domain, two real users, a live payment, a failure — are outside that loop.

Which items are launch-blocking?

Secrets out of the repo and browser, paid APIs called server-side, database access rules, and auth that works on your real domain. Everything else is important; those four are dangerous to launch without.

Can I do the last 20% myself?

Some of it — the checks in the 'this week' section above need no engineering. Items 2, 3, 7, 9 and 10 generally need someone who has done them before. The cost of getting item 3 wrong is your users' data.

Is this list the same for every tool?

Yes. Lovable, Cursor, Bolt and Replit break in different places, but the fourteen items are properties of production software, not of any tool.

Vibe coding

Your vibe-coded MVP is 80% done. Here's what the last 20% actually involves.

Author

AI Cubed

Published

September 9, 2026

Read time

12 min

"It's about 80% done" is the most common sentence we hear from someone who built an app with Lovable, Cursor, Bolt or Replit. It's usually accurate about the visible product: the screens exist, the core action works, the demo lands. It's usually wrong about what's left, because the remaining work isn't 20% of the same kind of thing. It's a different kind of thing.

This guide itemises it. Fourteen items that separate a working demo from something you can safely give to a stranger with a credit card, with why the AI didn't do each one and roughly how long each takes when done properly. If you only read one table this month, read the first one.

What 'the last 20%' actually contains

Here is the full list. The effort column assumes an experienced engineer working on a typical single-tenant web app with a database and a handful of third-party APIs. Double it if you're learning as you go; halve it if the item is genuinely not applicable.

The fourteen items between a demo and a product
#	Item	Why it's missing	Typical effort	Blocking?
1	Secrets out of the repo and the browser bundle	The fastest way to make a feature work is to paste the key where it's needed.	1–2 days incl. rotation	Yes
2	Paid APIs called from the server, never the client	Calling OpenAI or Stripe from the browser works in a preview.	1–3 days	Yes
3	Database access rules (RLS, Firestore rules)	Tables get created; policies either don't or are set to allow everything.	2–4 days incl. testing	Yes
4	Auth that works on your domain, on phones, after refresh	Preview and production are different origins; redirects were never set for the real one.	1–3 days	Yes
5	Separate environments (dev / preview / prod)	There was only ever one.	1–2 days	No
6	Payments verified in live mode, webhooks included	Test mode is what the demo used.	1–3 days	No (unless you charge)
7	Schema as versioned migrations, matching production	Changes were made in a dashboard.	1–3 days	No
8	Error handling and failure states	The happy path is the only one a prompt describes.	2–5 days	No
9	Tests around the money paths	Nothing in a demo needs them.	2–5 days	No
10	Deploy from the repo, with rollback	The tool hosted it; nobody set up anything else.	1–2 days	No
11	Monitoring and alerts	Nothing had failed yet.	0.5–1 day	No
12	Backups, tested by restoring one	Same.	0.5–1 day	No
13	Performance on real data volumes	Demo data is ten rows.	1–4 days	No
14	Legal pages and account ownership in your name	Nobody asked.	0.5–1 day	No

Add it up and a typical MVP has two to four weeks of this work. That's the honest size of "the last 20%." It is not a weekend, and it is not a rewrite.

Why did the AI skip all of this?

Because none of it is visible in a preview. AI coding tools optimise for the thing you can see and click. A prompt says "add login" and the tool adds login that works in the environment it's running in. Nothing in that loop ever loads the app on your phone from your domain after a refresh, or logs in as two different users to check whether they can see each other's data, or runs a live-mode payment. The tool isn't cutting corners; the corners are outside its field of view.

This is also why the list is so consistent across Lovable, Cursor, Bolt and Replit. The tools differ in where they break — Lovable in Supabase policies, Cursor in agent-mode edits, Bolt in the browser sandbox, Replit at the workspace-to-deployment boundary — but the fourteen items are the same, because they're properties of production, not of any tool.

The order to do it in

Sequence matters more than people expect, because some items make others safe to do. This is the order that minimises risk while you work.

Rotate and relocate secrets (item 1). Do this first, today, before anything else. If a key was ever in the repo or the browser, assume it's compromised.
Move paid API calls server-side (item 2). Until this is done, someone can run up your bill from the browser console.
Database access rules (item 3). Until this is done, any logged-in user can read every other user's data. Test with two real accounts.
Auth on the real domain (item 4). Now that the data is protected, make sure the right people can get in and stay in.
Environments and migrations (items 5 and 7). Now you can make changes without breaking production.
Payments in live mode (item 6). One real transaction, one refund, webhook verified.
Error handling, tests, deploy and rollback (items 8–10). The app now fails gracefully and can be fixed quickly.
Monitoring, backups, performance, legal, ownership (items 11–14). The app now tells you when something's wrong, and it's yours.

How each tool leaves things — the short version

Where the last 20% usually starts, by tool
Tool	Where it usually stalls	First thing to check
Lovable	Supabase RLS missing or permissive; auth redirects still pointing at the preview URL; edge-function secrets.	Open the Supabase dashboard and count tables with no policies.
Cursor	Agent-mode edits across shared files; three patterns for one concern; hallucinated imports; no lockfile.	Run `tsc --strict`. Count the errors.
Bolt.new	Only runs in the browser sandbox; auth breaks after Supabase; truncated files on large projects.	Clone it and run it on a real machine.
Replit Agent	Works in the workspace, fails in Deployment; secrets set in one and not the other; database ambiguity.	Open the Deployment logs. Read the first error.
v0 / Claude Code / ChatGPT-paste	Beautiful components, no backend decisions made at all.	Ask where the data lives. If the answer is unclear, start at item 3.

We keep tool-specific checklists for each of these: Lovable, Cursor, Bolt and Replit to production.

What you can do this week, without an engineer

Search the repo for `sk_live`, `sk-`, `service_role` and `SECRET`. Anything you find, rotate today.
Log in as two different users. Try to load the other one's data by changing an ID in the URL. If it works, item 3 is your emergency.
Load the app on your phone, from your real domain, log in, close the browser, reopen it. Still logged in? Good. Log out. Reset your password. Every step that fails is item 4.
Run our free vibe-code audit. It walks through the same fourteen items and reads your repo's file tree for the ones a tree can prove.
Write down, in one paragraph, what the app does and what's broken. You'll need it whoever you hire.

When to fix and when to rebuild

If the core flow has ever worked end to end for a real user, fix it — the fourteen items are additive and don't require starting over. If it has only ever worked in a demo, the stack is unusual, or the schema has been reshaped repeatedly, a rebuild may be cheaper. Our fix-or-rebuild framework goes through the test in detail.

What AI Cubed does about this

We audit vibe-coded apps against exactly this list in two business days and finish the last 20% — usually in two to four weeks — leaving you with a production app you own. Start with the free audit tool, or read about vibe-coding rescue.

Frequently asked questions

Sources

Row Level Security — Supabase Docs
Receive Stripe events in your webhook endpoint — Stripe Docs
OWASP Top 10 — OWASP

Start here

See where your operation is losing time.

Twenty minutes with an operator, not a salesperson. We'll name the one bottleneck costing you the most — and tell you whether it's worth fixing with software at all.

Book your free 20-minute consult→

20 minutes · video call · no preparation needed