Skip to content

field notes · rescue

Vibe Fix

Vibe FixAn isometric drawing of a prototype being turned into shippable software. On the left, on a bench marked no tests yet, the prototype is one lumpy box: a screen, logic tangled into its side wall, an open hatch, a chunk hardcoded to localhost, and an API key lying in front of the screen. Audit sweeps a lens across it and plants three vermilion flags: the exposed secret, a security gap and a deploy blocker. Refactor pulls it apart into floors: the client screens on top, a core with ports and plug-in adapters for auth, payments and the database in the middle, a server floor with a vault the key moves into, and test blocks along the bench underneath. Ship sends a release along a belt through three CI gates (unit, integration, end-to-end) to a staging pad and then a live pad, with a monitor showing a heartbeat at the back and a rollback lever at the front. Pressing a step out of order says what needs doing first.the appcideployno tests yetstaginglivelocalhostend-to-endintegrationunit1234567

A prototype from v0, Lovable or Bolt.new: screens, logic and an API key in one lump. It works, but would you trust it? Press audit.

Your v0, Lovable or Bolt.new prototype, turned into a SaaS you can ship.

Book a free first callEstimate the cost

In short

Vibe Fix turns an app built with AI tools such as v0, Lovable or Bolt.new into software that's safe to put in front of paying users. It's for founders whose prototype works but who don't trust the code behind it. Zenoware, an Auckland studio, audits the generated code, fixes security gaps, refactors the logic so it can be tested and sets up CI/CD and monitoring. It starts with a free first call and a look at your repo.

What you get

  • Exposed secrets, security gaps and deploy blockers found

  • Business logic pulled out of the UI, with tests

  • CI/CD, monitoring and rollbacks before real users arrive

How it runs

  1. 01

    Audit

    We read what the AI wrote and report security gaps, type holes and deploy blockers.

  2. 02

    Refactor

    Logic comes out of the components and into ports and adapters you can test.

  3. 03

    Harden

    Strict TypeScript, input validation, rate limits, CSP headers and secrets kept off the client.

  4. 04

    Ship

    Unit, integration and end-to-end tests run in CI before every staged deploy.

Who you'll work with

JP Caparas

JP Caparas

Founder and lead engineer

Thirteen years of principal engineering, including development lead at Public Trust. OpenAI Codex and Devin ambassador in New Zealand. You talk to the person who writes the code.

About the team

Questions

What is vibe-coded software?

Software built mostly by prompting an AI tool and accepting what it writes, without anyone reading the code closely. Andrej Karpathy coined the term vibe coding in early 2025. It's quick for getting a prototype working, but the code often hides security gaps and logic that's hard to change.

Is code from Lovable or Bolt.new production ready?

Usually it's a good demo that isn't ready for real users yet. The gaps we see most are missing tests, API keys sitting in the browser, database access rules left wide open, hardcoded values and business logic tangled up in UI components.

How do I make an AI-generated app production ready?

Audit it first so you know what you've got. Then put tests around the flows that matter, move secrets to the server, validate every input and set up CI with monitoring. Refactor in small steps and keep the app working the whole way through.

Should I rewrite my vibe-coded app from scratch?

Usually not. A working prototype already holds a lot of product decisions, and starting again means rediscovering every edge case. Refactoring keeps what works and replaces the risky parts, which tends to be quicker and safer.

What is ports and adapters architecture?

It's also called hexagonal architecture. Your core logic talks to interfaces (the ports), and adapters plug those into a particular auth provider, payment gateway or database. Swapping providers means writing a new adapter, and the core can be tested with fakes.

You might also need

Tell us what isn't working.

The first call is free, and we'll tell you straight whether we're the right people for it.

Start a project