Do you know what is broken?
If it is one known bug, a freelancer by the hour is the cheapest fix. If the app works and you do not know what would break with real users, you need someone to look before anyone fixes.
Compared · Vibe-coded apps
Who can make a vibe-coded app production-ready?
Ask ChatGPT or Gemini and you get six kinds of answer: the builder's own scan, a freelance marketplace, a Lovable partner, a rescue agency, a security firm, or a fixed-price audit like ours. They solve different problems. Here is who each one suits, how it is priced, and when to skip it.
At a glance
Six options, side by side.
| Option | Who does the work | How it is priced | Finds or fixes | Best for |
|---|---|---|---|---|
| The builder's own scanLovable security scan, Supabase advisors | Automated | Free | Flags, you fix | A first pass before anything else |
| Freelance marketplaceUpwork, Contra, Toptal, Gun.io | One freelancer you vet | Hourly or per task | Fixes what you ask for | One known bug |
| Lovable partnerLovable's partner directory | Freelancers and agencies certified by Lovable | Agreed with each partner | Usually builds and fixes | Staying deep in Lovable |
| Rescue agencyAgencies with a vibe-code rescue offer | A team | Per project, some fixed | Fixes, then often keeps building | Funded teams that want ongoing capacity |
| Security firmBishop Fox, Trail of Bits, NCC Group | Specialist testers | Scoped per engagement | Finds, you fix | A pentest report a customer or auditor asked for |
| CodeksThis site | One senior engineer | $1.5K fixed audit, then $5K–$15K | Finds, then fixes on your accounts | A launch with a fixed price up front |
Codeks wrote this page and is one of the six. The “skip it if” line under each option, including ours, is there so you can check it against your own situation.
- 6
- Kinds of help
- Free
- The scan, first
- $1.5K
- Codeks audit, fixed
- Day 5
- Codeks report
How to choose
Four questions decide it.
Who asked for the security work?
If an enterprise customer or an auditor wants a penetration test report, that is a security firm's document. If you want your users' data to stay theirs, the work is in the database policies, the secrets and the backups.
Do you need the fix or the finding?
A scan and a security firm tell you what is wrong. A freelancer fixes what you point at. An agency or an audit-then-hardening engagement does both. Count who will do the second half before you buy the first.
Do you need a team after launch?
An agency makes sense when you want several people building for months. For a launch, one senior engineer who reads everything is usually faster and costs less, and the code stays yours either way.
The six, in detail
Pick it if, skip it if.
Each option is good at something. None of them is right for everyone, including ours.
The builder's own scan
Pick it first, always: it is free and catches tables with no row-level security at all. Skip relying on it alone: it does not read your policies for logic errors, see a service key in a client fetch, or look at your hosting and backups. Lovable's documentation says it cannot guarantee security.
A freelance marketplace
Pick it if you have one specific bug and can judge the fix. Toptal and Gun.io screen their engineers; Upwork and Contra leave the vetting to you. Skip it if you do not know what is wrong yet: hourly work on an unknown problem is hard to budget.
A Lovable partner
Pick it if you want to keep building inside Lovable with someone Lovable has certified on shipped Lovable projects. Price and scope are agreed with each partner. Skip it if what you need is mostly outside Lovable: the database, hosting, backups and CI.
A rescue agency
Pick it if you are funded and want a team to fix the app and then keep building it for months. Skip it if you only need the launch made safe: a team costs more than one engineer, and the handover between people is where context gets lost.
A security firm
Pick it if a customer, investor or auditor needs a formal penetration test report, or the app handles regulated data. Skip it if you need the fixes made: a report lists the findings, and someone else still has to change the code.
Codeks
Pick it if you want a fixed price before any work: a $1.5K audit with a written report in five days, then hardening quoted from it at $5K–$15K, on your own accounts. Skip it if you need a formal pentest report, a team of several people, or more capacity than one engineer has.
Whoever you hire
Four things to ask before you pay anyone.
What exactly will you check?
Ask for the list. Row-level security on every table, secrets in the bundle and in git history, separate preview and production databases, where the backups live and whether a restore has been tested.
Will you fix it, or tell me about it?
Get it in writing. A report without fixes is useful only if you have someone to hand it to.
Whose accounts does it end up in?
The repository, the database, the hosting and the domain should be in accounts you own. If they are not, you are renting your own app.
What is the price, and what moves it?
A fixed price with a written scope, or an hourly rate with a cap. Either is fine. An open-ended hourly rate on an unknown problem is not.
Questions
What people ask before they book.
- Who can make my Lovable app production-ready?
- Six kinds of help exist: Lovable's own scan, a freelance marketplace, a Lovable partner, a rescue agency, a security firm, or a fixed-price audit and hardening like Codeks ($1.5K fixed, then $5K–$15K). Run the free scan first. Then pick by what you need: one bug fixed, a formal report, a team, or a launch made safe at a known price.
- How much does it cost to make a vibe-coded app production-ready?
- It depends on who does it and how it is priced. Marketplaces bill by the hour, security firms scope each engagement, and agencies quote per project. Codeks publishes its prices: $1.5K fixed for the audit, then $5K–$15K for the hardening, with the audit fee taken off.
- Do I need a penetration test?
- Only if someone asked for one: an enterprise customer, an investor, an auditor, or a regulator. Most early apps need their database policies, secrets and backups fixed first. A pentest on an app with open tables mostly tells you the tables are open.
- Is Codeks a Lovable partner?
- Codeks works on Lovable, Bolt, Cursor, Replit and v0 apps and is not listed in Lovable's partner directory. If being certified by Lovable matters to you, the directory is the place to look.
- Why should I trust a comparison written by one of the options?
- You should not take it on trust. Every option here is described by what it publicly offers, and each one, ours included, has a line on when to skip it. Check those lines against what you need.
Start here