Your vibe-coded app has real customers now, and it's getting harder to change. Each prompt fixes one thing and breaks another, and the AI keeps rewriting components it wrote last month. Somewhere in your searching you found agencies selling "vibe code cleanup". This post covers what that work involves and how much of it you can do yourself.
If nobody on your team writes code, the last section also covers Refinar, which lets the product owner change a running copy of the app and won't push sign-in or payment changes out on its own.
What cleanup means for an AI-built app
Cleanup isn't a rewrite. It's the work that makes the code safe to change again, whether the next change comes from a developer or from another AI session. In practice it comes down to four jobs, roughly in this order. Close the security holes, add tests to the paths that earn money, delete and merge duplicated code, and put a review step between any change and your live app.
Signs your app is due one
- A small change takes several prompts and still breaks a screen you didn't touch.
- The AI says it fixed a bug, and the bug is back a week later.
- Nobody, the AI included, can say where a rule like pricing or permissions is decided.
- A developer asks for days just to understand the code before quoting for a change.
Why AI-built code needs it
The duplication part has numbers behind it. GitClear analysed 211 million changed lines of code written between 2020 and 2024 for its 2025 code quality report. In 2024, for the first time in GitClear's data, lines copied and pasted within a commit outnumbered lines that were moved, and moving code is the usual sign of refactoring. Moved lines fell from 25% of changes in 2021 to under 10% in 2024, while code blocks with five or more duplicated lines became eight times more frequent in a single year.
In an app, that can look like a pricing rule living in two components. The AI fixes one and the preview looks right, while the other keeps charging the old price. Every duplicate is a place a future change can miss, and that's most of what people mean by AI technical debt.
A cleanup order that works
- Get the code somewhere you own. Transfer the repository to a GitHub organisation your company controls. Lovable syncs both ways with GitHub, and on paid plans you can also download the codebase (Lovable app to GitHub walks through it).
- Close the security gaps first. Row Level Security and exposed keys come before anything cosmetic. Work from the web app security checklist, and let the broken-app check look for keys in your public JavaScript.
- Name the paths that matter, then test them. Sign-up, sign-in, checkout and whatever your customers pay for. Add automated tests there before anyone restructures the code, so a tidy-up that breaks one of them gets caught.
- Delete what's dead. Unused pages, packages nobody imports, components the AI replaced but never removed, and blocks of commented-out code.
- Merge the duplicates. Aim for one function per business rule and one place that decides what each plan includes.
- Put database changes into migrations. Supabase's production checklist suggests that projects on the Pro plan use branching to test migrations in a preview environment before they reach production.
If you're doing this with the AI itself, Lovable's debugging guide suggests asking for a codebase audit in Plan mode that reports without changing any code, then applying the recommendations one at a time and checking each in the preview. That shape works in any tool. One change per prompt, checked before the next.
Do it yourself or hire someone?
You can reasonably do it yourself when the app is small and holds no payment or health data. Steps 1 and 4 mostly need patience, and the free checks linked in step 2 will point you at the worst of the security gaps.
Hire when the app takes payments or stores sensitive personal data, or when every fix seems to break something else. The same goes when a developer is about to join, since they'll need code they can work in from day one.
Redwerk and Ulam Labs, two of the agencies that rank for this search, don't publish prices on their cleanup pages, and both start by assessing the code. Ulam Labs lists a free assessment that takes three to five days. Redwerk says a small project might need one to two weeks for the assessment and the critical refactoring. Whoever you talk to, ask for the assessment as a written list you keep, with a fixed scope, before agreeing to open-ended sprints. That list is useful even if you end up doing the work yourself.
If you'd rather start again from a clean base, Refinar's Foundation service has a developer build that base in three business days for a fixed $1,000, with sign-in, payments and row-level security set up properly. Price that against the cleanup quote before you decide.
Keeping it clean after the cleanup
Cleanup decays quickly if the next round of prompts goes straight to the live branch. The habits that hold it in place are small.
- Protect the main branch. GitHub's branch protection can require a reviewed pull request and passing checks before anything merges. On a private repository, that needs a paid GitHub plan.
- Keep each change to one outcome, and watch it running before it merges.
- Send changes to sign-in, payments, customer data or database rules to someone who reads code.
- Re-run the tests from step 3 on every change, including the ones that look cosmetic.
Refinar is built around those habits. Your app runs in a cloud sandbox, opened from the repository you already have on GitHub, and an AI agent makes each change while you watch the live preview. Any change can be undone until it's published. Work lands as a draft pull request your protected branch can hold, unless you choose to publish it. Changes touching sign-in, payments or customer data never go out automatically. Refinar builds whatever part is safe and hands the rest to your developer, perhaps someone you invite to your team, along with a written brief. With no developer, one of Refinar's developers takes it within 4 hours on business days. Plans cost from $50 a month (pricing).
If your cleanup keeps getting undone by the next prompt, try one change the reviewed way.