Hiring a developer to fix your vibe-coded app: what to check, what to ask

Your app worked in the demo and broke with real users, and now you're looking for someone to fix it. A developer or agency worth hiring makes three things clear before anything else: no fixed price before they've read the code, an NDA before you share anything, and read-only access to start. If one of those is missing, the risk sits on you, not on them.

How to tell an experienced developer from the first message

It shows immediately. Someone who has done this before asks which tool built the app: Lovable, Bolt, v0, Cursor, Claude Code, Replit, Base44, or Firebase Studio. The answer changes what they're actually looking at. Some of these tools hand you a plain React or Next.js codebase; others keep the output tied to their own platform. Then they ask for repository access before they talk price. Anyone who quotes a number in the first message is either guessing without reading the code, or selling you the guess.

Either way, you end up with a surprise invoice later.

Five questions worth asking in the first call

Ask them in order. The speed of the answer tells you as much as the content.

1. Will you read this knowing which tool generated it, or treat it like a generic Next.js project?
2. Of the handovers you've taken on, roughly how much gets kept versus rewritten?
3. How long does the code review take, and is it billed?
4. Do you send your own NDA, or will you sign one my side drafts?
5. After handover, whose account do the domain, hosting, and API keys live under?

Red flags: end the call when you hear one of these

Any single one of these five is reason enough to walk.

How the handover should actually run

Three steps, in this order, and none of them skipped. First, read-only repository access and a code review: what exists, what runs, what's dangerous. Second, an NDA before anything deeper, so the review can go into real detail without you exposing more than you have to. Third, scope and price, quoted from what was actually found rather than a guess. This is also how Lumiasoft's own AI-project handovers run: we sign an NDA before anything is shared, access is read-only, and it's revoked the moment the review ends.

If the app came out of Lovable or Bolt, exporting the codebase is its own step before any of this, since what leaves the platform isn't always the whole picture. Our walkthrough of exporting Lovable code to GitHub covers what comes with it and what doesn't.

Three commands to run in the first five minutes of read-only access

Once you have read-only access, you don't have to take anyone's word for the code's condition. These three checks take five minutes and catch the most common vibe-coding failures: leaked credentials, hardcoded keys, and an unprotected .env. We ran all three against Lumiasoft's own repository to show real output, not invented numbers.

$ git log --all --diff-filter=A --name-only --pretty=format: \
  | grep -iE '\.env($|\.[a-z]+$)' | sort -u

.env.example

$ grep -rInE "sk-[A-Za-z0-9]{20,}|AIzaSy[A-Za-z0-9_-]{20,}|AKIA[A-Z0-9]{12,}" \
  --include=*.js --include=*.jsx --include=*.ts --include=*.tsx . \
  | grep -v node_modules

(no output)

$ cat .gitignore | grep -i env

.env*.local
.env
.env.bak*

Freelancer or agency: which one actually fits this job

Both can do the work. The difference shows up in what happens after the handover, not during it.

Neither column makes the other wrong. A freelancer with a track record and clear communication can outperform a slow agency. The question that actually matters is who answers if something breaks six weeks after launch.

Why the price isn't a fixed number

Two projects that look identical from the outside can be completely different underneath. One is three days of cleanup, the other is six weeks of rebuilding auth and payments from scratch. Anyone quoting before reading the code is quoting the outside, not the inside. If you want a rough sense of scale before that call, the vibe coding cost calculator estimates a range from what your project actually has, not a generic hourly rate.

When rescuing is cheaper than rewriting, and when it isn't

Rescuing wins when the interface and the core logic work and the damage is contained to specific layers: auth, payments, database access. A developer who reads the code first will usually say so early, because saving what works is less billable time than rewriting it.

A rewrite wins when the data layer and the security model are wrong throughout, not in one place, or when the app was built for a demo and the real requirements never made it into the code at all. Sometimes a good reviewer tells you this on the free call, before you've paid for anything. That's a sign to trust, not a sign to push back on.

When this guide doesn't apply

If your app has no real users yet and no real data at risk, hiring anyone may be premature. Fixing it yourself, slower but for free, is a reasonable call at that stage. Our guide to shipping vibe-coded projects correctly covers the discipline that keeps a solo build from reaching this point in the first place.

FAQ

Is the first code review really free?
Often, yes, but it isn't universal. Ask directly before you send access, and treat a refusal to even discuss it as its own small red flag.

What access do I actually need to give?
Read-only repository access is enough for a review. Nobody doing this properly needs your account password or full admin rights at this stage.

What if they refuse to sign an NDA?
Walk away. A legitimate reviewer signs one without being asked twice, because it protects them as much as it protects you.

Should I hire one developer or an agency?
Use the comparison above. It comes down to where you'd rather carry the risk: a single point of failure with a lower price, or more continuity at a higher one.

Does handover fully cut ties with the original AI tool?
Depends on the platform. Tools that export plain React or Next.js code leave cleanly. Others keep pieces tied to their own infrastructure, which is exactly what an export step is meant to catch.

If nobody has read your credential setup and backup story line by line since the app went live, that first code review is where our own AI-project handover process starts too.