Do not rewrite the whole app. Get it into git and onto a real URL first, then replace the layers that lose money or leak data. Most Lovable-to-production exits take 2 to 4 weeks if you keep the UI and fix the foundations in this order.
1. Repo and deploy
Export the code. Put it in a git repo you control. Deploy from main to a custom domain with preview deploys. Until this exists, every other change is unsafe.
Done means: a teammate can clone, run, and see the same app you see.
2. Schema and migrations
Write the real data model. Add a migration tool (Drizzle or Prisma). Move existing data with a one-off script. Turn on row-level security if more than one customer will share the database.
Done means: you can change a column without clicking around in a dashboard, and you have restored a backup once.
3. Auth
Swap the hand-rolled or half-wired auth for Clerk, Supabase Auth, or Auth.js. Map existing users across. Never trust the client for the user ID.
Done means: password reset, session refresh, and a delete-account path all work.
4. The server boundary
Move business logic out of components into typed server actions or API routes. Validate every input on the server. Add timeouts to every external call.
Done means: a user cannot change their own plan, role, or another user’s records from the browser.
5. Payments
Use Stripe (or Paddle / Lemon Squeezy) with verified, idempotent webhooks. Failed payments must downgrade access. Invoices must show your legal entity.
Done means: you have charged and refunded a real card, once.
6. Observability, then features
Sentry (or similar), uptime, and the four product events: signed up, activated, paid, churned. Only then build the next feature.
What to keep
UI components and most page layouts. AI tools are genuinely good at those. Do not spend a month redrawing screens that already convert in a demo.
What to ask before you hire
- “What would you keep from this codebase?” If the answer is “nothing,” walk.
- “Who owns the repo and the Stripe account on day one?” You do.
- “How do you roll back a bad deploy?” If they cannot answer in one sentence, they have not shipped.
The full audit, keep/wrap/rewrite matrix, and cost ranges live in the Vibe-Code Exit Playbook. If you want a timeline against your repo, send it over. We will tell you what we would keep.