Your AI-built app broke: rescue it or rebuild it? A cost and risk guide

What is usually wrong when an AI-built app breaks?

Apps generated with Lovable, Bolt, Replit, v0 or Cursor tend to fail in the same places: the tools optimise for a demo that works on screen, not for real users, real data and a second developer. The symptom is rarely the cause, so match it first.

This is not bad luck. In Veracode's 2025 tests of more than 100 language models, 45% of code samples failed security checks. GitClear's review of 211 million changed lines saw copy-pasted code rise from 8.3% to 12.3% between 2020 and 2024, and duplicated logic often lets a bug fixed in one place survive in another.

What should you do in the first 48 hours?

Work in order of damage, not annoyance: a slow page loses some visitors, an open database can lose your customers' data.

1. Freeze and copy: stop prompting the builder to “fix it” on the live app, push the code to a Git repository you own and back up the database.
2. Close the leaks: rotate every key that has been in the browser or the repository, move secret calls to the server, enable RLS on every public table and test it logged out.
3. Protect the data: find duplicated or orphaned records and put delete, refund and bulk-edit actions behind a role check.
4. Keep it up: add error logging, then walk through sign-in, payment and the main order flow by hand.
5. Only then, speed: indexes, pagination and caching.

If personal data may have leaked and you serve people in the EU, GDPR Article 33 gives the controller 72 hours from becoming aware of it to notify the supervisory authority, unless the breach is unlikely to put people at risk. A lawyer writes the notice; a developer tells you what was exposed and since when.

Rescue or rebuild: how do you decide?

Check five signals. If two or more land in the right-hand column, ask for a rebuild estimate before paying for more fixes.

Joel Spolsky's classic argument against rewrites is that old code holds years of bug fixes found in real use. An app generated over two weekends has no such history; its value is the data, the flows users rely on and what you learned. So a rebuild wastes less than it sounds, provided the live app keeps running meanwhile.

The safest middle route is what Martin Fowler calls the strangler fig: new, tested parts take over one flow at a time behind the running app. One cleanup guide's rule of thumb: clean up while the total stays under $5,000, and rebuild when estimates pass $8,000 and the app took only days to build.

What does a rescue cost on the market in 2026?

These are asking prices published by companies that sell the work, not audited averages.

Why the gap? Our packages are narrow and fixed: one fault, five listed faults, or a rescue that maps failures, protects critical flows and ships agreed repairs. A $20,000 rebuild is another product. If the failure map shows you need one, you get its estimate in writing first, and the map becomes its specification.

What makes one rescue cost ten times more than another?

Axonbuild counted about 3.4 critical issues per app, plus roughly 40 optional findings, across 21 AI-built apps it audited in June and July 2026. The critical few set the price, and these factors set how hard they are:

• Roles: admins, staff and customers mean every rule is checked per role.
• Several client companies in one database: separating tenants runs $3,000–$8,000 in the vibecoding.app list.
• Payments and webhooks: tested in the provider's sandbox before anything changes.
• Integrations: each adds keys, limits and failure cases.
• Access: Git, a staging copy and logs beat screenshots and a shared login.
• Timing: the same guide puts cleanup before launch at two to five times cheaper than after.

Can you keep building with AI after the rescue?

Yes. Developers themselves are wary: in Stack Overflow's 2025 survey, 66% named AI answers that are “almost right, but not quite” as their top frustration. Keep AI, but put checks between the prompt and production:

• Every change goes through Git and a pull request, even when AI wrote it.
• Tests on sign-in, payment and the main flow block a failing release.
• Secrets stay on the server; the browser gets publishable keys only.
• Each release is checked before it goes live and can be rolled back.
• A person who reads code approves changes to data rules and permissions.

QA and test automation sets up that net without a rescue, for $73 AI-assisted or $93 human-led.

What should you send to get an accurate quote?

• Read access to the repository, or an export from the builder.
• The stack: builder, database, hosting, sign-in and payments.
• Three failures written as steps: what you did, expected and got.
• The flows that bring in money or leads, ranked.
• How many users there are and what personal data is stored.

Never paste passwords into a chat; create collaborator accounts you can revoke after handoff.

When should you not pay for a rescue?

• The app has no users and was a test of an idea: note what you learned and build a clean version from a proper spec.
• The fault is in the platform itself: report it to the builder's support first.
• You need a new feature, not a repair: that is development and is priced as such.
• You are about to pivot: rescuing code you will discard next month means paying twice.

Be wary of anyone who promises to fix everything in a day without reading the code.