How to deploy your vibe-coded app
What is vibe-coding?
Vibe-coding is software development where an LLM agent (Cursor, Lovable, Bolt, v0, Claude Code, Replit Agent) writes the code and the human acts as customer and editor. It produces working prototypes in hours instead of sprints. It does not produce production systems. AI tools optimize for code that compiles and passes smoke tests on localhost. They do not configure PgBouncer, rotate secrets, add HSTS headers, or notice that /admin/users is exposed without authentication.
Why do vibe-coded apps break in production?
Every vibe-coded codebase that has been through our Valletta.Rescue audit fails in the same seven ways:
- No CI/CD. Manual deploys, no staging, no rollback. With AI generating changes fast, every release carries three sprints of untested code.
- No observability. Errors swallowed by console.log. The only signal something broke is a user complaint.
- Secrets in git history. Hardcoded API keys and database URLs. Removing them from the current commit is not enough — anyone who cloned the repo took them.
- Endpoints without auth checks. JWT validated on login but not on protected routes. User A hits /api/users/B/documents and sees user B's data. CVSS 9+.
- Database queries without indexes. O(n) scans that work at 1,000 rows and die at 100,000. N+1 patterns everywhere. No connection pooling.
- Dependencies with known CVEs. Run npm audit or pip-audit and you get dozens of CRITICAL and HIGH findings. ML models deployed by copying a pickle file. No experiment tracking, no model registry. Reproducing a training run two months later is impossible.
What is the minimum CI/CD pipeline a vibe-coded app needs?
GitHub Actions on push to main: lint and type-check, unit tests covering critical paths, multi-stage Docker build, push to ECR or GCR tagged with git SHA, auto-deploy to staging with smoke tests, manual approval gate before production. Rollback is one command to revert to the previous image.
What is the minimum observability stack for a startup?
Under $100/month: structured JSON logs with request ID and user ID, Sentry for uncaught exceptions (5,000 errors/month free), Prometheus scraping the app's /metrics, Grafana with the four golden signals (latency, traffic, errors, saturation), OpenTelemetry plus Tempo for tracing at 10% sampling. Start with three alert rules: error rate > 1%, p95 latency > 2s, pod restarts > 0.
What MLOps does a startup actually need?
For 1–10 models in production, the right stack is: MLflow self-hosted on a $20/month VPS for experiment tracking and model registry, DVC for data versioning, FastAPI in a Docker container on ECS or Cloud Run for serving, GitHub Actions for retraining pipelines, Evidently for weekly data drift reports. Skip Kubeflow until the pain demands it. Define who owns the model on-call before it degrades at 3am.
Why not have the same AI that wrote the code fix it?
LLMs work well in local context (one file, one function) and systematically fail at architectural decisions. PgBouncer in transaction pooling mode on a project using prepared statements is a typical AI mistake — and two days of debugging prepared statement does not exist errors. Security issues need adversarial expertise: spotting an IDOR in /api/users/:id/documents requires having seen IDORs in the wild. AI knows about IDOR in the abstract, not yours specifically. The pattern: AI writes 70% of the code, an engineer does the 30% where production actually breaks.
