How to maintain a vibe-coded app after the prototype works
AI coding tools are excellent at producing a working first version. Keeping it working while you add features, gain users and change providers is a different job. These are the practices we use on our own AI-assisted products, Cumpără cu AI and Raftul copiilor, written as a checklist an owner can follow or hand to a developer.
1. Get secrets and configuration out of the code
API keys, passwords and tokens belong in server-side configuration, never in the repository or the browser bundle. Check the git history too: a key committed once is a key to rotate. Keep a sample configuration file with names only, so anyone can set the app up without seeing a secret.
2. Protect the data before anything else
Back up the database every night, check each backup’s integrity, keep several generations and, at least once, restore one on a clean machine. Our sites run an online backup at night with an integrity check and keep the last three. When a supplier file once corrupted thousands of records, that morning’s backup let us restore them the same evening.
3. Write down the rules the app must never break
AI tools change code confidently and can undo a decision made weeks ago. Keep a short, numbered list of rules in the repository, in plain language, and give it to the AI tool at the start of each session: which partner APIs must never be called, which data must never be deleted, which wording must stay. Our products have such a brief, and every rule names who decided it and when.
4. Add tests where it hurts
You do not need full coverage. You need a test for each bug you fixed, for each rule in that list, and for the flows that make money or handle personal data. Run them before every deploy. For search or AI behaviour, keep a set of real examples with the expected result and treat a newly failing case as a blocker.
5. Make deploys boring and reversible
One command, the same every time, with a health check after the switch and a way back. Ours run the search-quality cases before and after a deploy and roll back automatically if a passing case fails. Never deploy during a heavy data job that locks the database.
6. Watch integrations and costs
Every external service will fail at some point: a feed changes format, a token expires, an email provider rejects a message. Log what each scheduled job did, alert on failures and unusual volumes, and cap anything billed per use. Our AI assistants have a daily spending cap with alerts at 50% and 80%.
7. Update dependencies deliberately
Pin exact versions with a lockfile, match your local runtime to production, and update one package at a time with the tests run in between. A surprise major upgrade can break an AI-built app without anyone touching its code, so treat unpinned versions as a standing risk.