The ceiling is real, and it’s not your fault
Lovable, Bolt, v0 and friends do something remarkable: they collapse the time from idea to clickable demo to a weekend. Then they stop. Around 70% done you hit auth that leaks, a database with no migrations, and a codebase that fights every change.
This playbook is the audit we run on every prototype that lands on our desk. Use it to figure out what you actually have, and what it will take to charge money for it.
Part 1: The 32-point audit
Score each line 0 (missing), 1 (exists but fragile), 2 (production grade).
Auth and users
- Sessions expire and refresh correctly
- Password reset / magic link works end to end
- Roles or permissions exist where money or data is involved
- No API route trusts the client for the user ID
- Account deletion exists (you will need it for GDPR / App Store)
Data
- A migration system exists (not “edit the schema in the dashboard”)
- Foreign keys and indexes are defined
- Row-level security or equivalent is on for multi-tenant data
- Backups are automatic and you have restored one
- No PII is stored in plain text that shouldn’t be
Security
- Secrets are in environment variables, not in the repo
- Input is validated server-side, not just in the form
- Rate limiting exists on auth and any AI-calling endpoint
- File uploads are size- and type-restricted
- Dependencies have been audited in the last 30 days
Payments
- Webhooks are verified and idempotent
- Failed payments downgrade the account
- Refunds and cancellations are handled, not just “contact us”
- Tax / VAT is handled (Stripe Tax, Paddle, Lemon Squeezy)
Reliability
- Errors are captured (Sentry or equivalent), not
console.log - Every external call has a timeout and a fallback
- A staging environment exists
- Deploys are automated from
main - You can roll back in under 5 minutes
Performance and UX
- Core Web Vitals are green on mobile
- Images are optimised and lazy-loaded
- Loading, empty and error states exist for every screen
- Analytics events fire on the moments that matter
Ownership
- The code lives in a git repo you control
- You can run it locally in under 10 minutes
- There is a README a new developer could follow
- No credential lives only in a co-founder’s browser
Scoring: under 32 you have a demo. 32–48 you have a beta. 48+ you can charge.
Part 2: Keep, Wrap or Rewrite
Don’t throw everything out. Sort each layer:
| Layer | Usually | Why |
|---|---|---|
| UI components | Keep | AI tools are genuinely good at this |
| Page layouts / routing | Keep with cleanup | Fine once dead pages are removed |
| Business logic | Wrap | Move it behind typed server functions, then improve |
| Database schema | Rewrite | Cheapest to fix now, most expensive later |
| Auth | Rewrite | Use Clerk, Supabase Auth, Auth.js. Never hand-rolled |
| Payments | Rewrite | Stripe with verified webhooks, nothing else |
| Infra / deploy | Rewrite | Vercel/Fly/Railway + preview deploys + CI |
Part 3: Migration order (no big bang)
- Repo and deploy first. Get it into git, deploying from
mainto a real URL. Everything else becomes safer. - Schema and migrations. Define the real data model. Write a one-off script to move existing data.
- Auth. Swap in a real provider. Map old users across.
- Server boundary. Move logic out of components into typed API/server actions. Validate input at the boundary.
- Payments and webhooks.
- Observability. Errors, logs, analytics.
- Then features. Not before.
Most exits take 2–4 weeks for a solo-developer-sized product. If someone quotes you 3 months, they are planning a rewrite you don’t need.
Part 4: Questions to ask before you hire
- “Show me a repo you took from prototype to production.” (Not a portfolio site.)
- “What would you keep from my current codebase?” (If the answer is “nothing”, walk.)
- “How do you handle migrations and rollbacks?”
- “Who owns the repo, the domains and the Stripe account on day one?” (You do. Always.)
What to do next
Run the audit. Whatever your score, you now know exactly what “production ready” means for your product. If you want us to run it with you, the first call is free.