---
title: "Code Rescue vs rewrite: the real math for vibe-coded MVPs"
description: "Code Rescue vs a full rewrite for a cracking Lovable or Bolt MVP: why most founders shouldn't default to a rewrite, with the decision framework and real costs."
url: https://zeroic.in/blog/code-rescue-vs-rewrite
---

[The Zeroic Journal](https://zeroic.in/blog)

[For founders](https://zeroic.in/blog/topic/founders) September 25, 2026 7 min read

# Code Rescue vs a full rewrite: the real math for vibe-coded MVPs

How to tell whether your cracking Lovable or Bolt app needs a targeted fix or a clean rebuild, and what each one costs.

By Khushi Arora Partner @ Zeroic

On this page

1. [Rescue fixes what’s missing. Rewrite fixes what’s wrong.](#rescue-fixes-whats-missing-rewrite-fixes-whats-wrong)
2. [What a Code Rescue covers](#what-a-code-rescue-covers)
3. [What a full rewrite costs](#what-a-full-rewrite-costs)
4. [The signals that point to a rewrite](#the-signals-that-point-to-a-rewrite)
5. [How to decide](#how-to-decide)
6. [What 100+ audits and FormulaBot’s growth to 1.5M+ users taught us](#what-100-audits-and-formulabots-growth-to-15m-users-taught-us)

On this page 6 sections

1. [Rescue fixes what’s missing. Rewrite fixes what’s wrong.](#rescue-fixes-whats-missing-rewrite-fixes-whats-wrong)
2. [What a Code Rescue covers](#what-a-code-rescue-covers)
3. [What a full rewrite costs](#what-a-full-rewrite-costs)
4. [The signals that point to a rewrite](#the-signals-that-point-to-a-rewrite)
5. [How to decide](#how-to-decide)
6. [What 100+ audits and FormulaBot’s growth to 1.5M+ users taught us](#what-100-audits-and-formulabots-growth-to-15m-users-taught-us)

Most vibe-coded MVPs cracking under real users need a Code Rescue, not a full rewrite. A rescue starts at $6k and takes 2-4 weeks; a clean-slate rebuild starts at $12k and takes 5-6 weeks, with no new features shipping meanwhile. Rewrite only when the data model is wrong or every fix breaks something else.

Most founders treat this as a binary: “our app is broken, we need to rebuild it from scratch.” The instinct is understandable, but it’s wrong most of the time. A full rewrite is a long bet that pays off when the structure itself is the problem. In every other case, a targeted Code Rescue costs less, ships sooner and keeps what already works. It comes down to which problem your app has.

## Rescue fixes what’s missing. Rewrite fixes what’s wrong.

Most vibe-coded apps have two separate failure layers that look like one.

The first is what wasn’t added: Row Level Security on Supabase tables, server-side ownership checks on routes that read sensitive records, error handling for external API failures, query indexes on foreign key columns, observability instrumentation. AI tools usually generate reasonable structure; what they skip is the finishing work. The product logic is sound, the production layer is thin.

The second is what was built wrong: a data model that assumes single-tenant structure when the product needs multi-tenancy, entity relationships that are backwards, payment logic woven into the UI layer, Bolt context-retention drift that’s introduced inconsistency across the codebase. These are architectural failures. No amount of targeted fixing resolves them.

A [Code Rescue](https://zeroic.in/services/code-rescue) addresses the first problem. A full rewrite addresses the second. The mistake almost every founder makes is treating two different problems as one.

## What a Code Rescue covers

Our Code Rescue starts at $6k and runs 2-4 weeks, opening with a 3-day review of the codebase, the data model and the deploy setup. From there, the scope is the production layer: four passes, in order.

**Auth hardening.** For a Lovable or Supabase-backed app, this is Row Level Security policies on every table, server-side ownership checks on every route that reads sensitive records, Stripe webhook signature verification, rate limits on auth endpoints. The research behind [CVE-2025-48757](https://mattpalmer.io/posts/2025/05/CVE-2025-48757/) crawled 1,645 live Lovable apps and [found 303 insecure endpoints across 170 of them](https://securityonline.info/cve-2025-48757-lovables-row-level-security-breakdown-exposes-sensitive-data-across-hundreds-of-projects/) (10.3%): tables such as `users` and `transactions` readable without authentication, because the client talks to Supabase with the public `anon` key and RLS policies were missing or insufficient. That scan covered apps already in production. Auth hardening usually takes 3-5 days, and it’s the fix that stops a data leak before your customers find it.

**Query optimization.** Enabling query logging, identifying N+1 patterns (clusters of near-identical queries with different ID values, caused by loading related records in a loop), adding eager loading or explicit JOINs on the hot paths. The [CodeRabbit December 2025 analysis](https://www.coderabbit.ai/blog/state-of-ai-vs-human-code-generation-report) of 470 open-source pull requests found AI-co-authored PRs averaged about 1.7x more issues than human-only PRs, with excessive I/O operations roughly 8x more common - the category N+1 patterns fall into. This is usually half a day to identify and a day or two to fix.

**Observability setup.** Structured error tracking (Sentry, Datadog, or equivalent), structured logging on payments and auth flows, basic alerting. In our experience Sentry takes an afternoon to instrument on a Next.js app. The payoff is asymmetric: you know about every unhandled exception before users do, rather than finding out from support tickets.

**Schema hygiene.** Indexing every foreign key column that doesn’t have one ([Postgres doesn’t add these automatically](https://www.postgresql.org/docs/current/ddl-constraints.html)), adding `deleted_at` to tables storing user-generated data, writing a rollback for the next migration. This lowers the odds that the next migration locks a live table at peak traffic.

Tests on the critical paths, documentation and 6 weeks of support round it out. A rescue rebuilds what’s failing and leaves what works alone. It doesn’t add features, and it can’t turn a structurally wrong data model into the right one. What it does is make the app you have survivable under real production load - before the incident that would have made it unignorable.

## What a full rewrite costs

A clean-slate rebuild through our [MVP Sprint](https://zeroic.in/services/mvp-development) starts at $12k for a 5-6 week engagement: auth, payments, AI and a production deploy. That’s the floor, scoped for a purpose-built product.

For a more complex app - 20+ integrations, custom reporting, multi-step onboarding - the scope grows with it, and at least one rescue shop [puts larger rewrites at $25k+ over 8-16 weeks](https://www.convergexai.com/blog/fix-my-vibe-coded-app-rescue-dont-rewrite-1). But the price comparison that makes rewrites look affordable ignores opportunity cost: every week the codebase is in a rebuild is a week with no new features shipping. For a pre-Series A company, three months of zero feature development can be fatal.

There’s also a technical trap in rewrites: you pay to rebuild everything that works in order to fix the few things that don’t. If the auth layer needs replacing and the query surface needs fixing, but the product flows are solid and the data model is sound, a rewrite replaces the whole app to fix two layers.

Rewrites pay off when the structure itself is the problem: when fixing one thing keeps breaking another, when every change ripples through unexpected dependencies, when the data model is wrong. There, targeted fixes don’t add up to stability - they just move the instability around, and a clean-slate build becomes the honest answer.

## The signals that point to a rewrite

You can check for each of these:

**Adding any feature takes weeks instead of days.** When a two-day task routinely becomes two weeks because every change ripples through unexpected dependencies, the architecture is fighting you. No targeted rescue resolves architectural coupling.

**The data model needs fundamental changes.** If the product needs multi-tenant isolation and no `org_id` exists anywhere in the schema, or if the core entity relationships are wrong, Code Rescue can’t unwind that. Fixing the schema at that level breaks every query in the app - which is, functionally, a rewrite delivered in painful increments.

**The Bolt app has outgrown what Bolt can hold in its head.** On larger Bolt projects, each new prompt works with [partial memory of earlier decisions](https://dupple.com/reviews/bolt), and the code drifts: the same thing done three different ways, fixes that break unrelated screens. A targeted rescue doesn’t help when every fix introduces a new regression in a different area.

**The audit finds that most of the app needs replacing.** If auth is structurally compromised, the data model is wrong, error handling is missing throughout, and the integration layer needs rebuilding, at some point the rescue math stops working. We run that calculation explicitly in the review at the start of every engagement.

## How to decide

The decision tree isn’t complicated:

**Rescue when:**

- The core flows work and the problems are in what was left out - auth policies, error handling, observability, indexes
- Users aren’t complaining about the product itself, just the reliability
- The data model survives its next migration without structural changes
- Adding a feature still takes days

**Rewrite when:**

- Every change breaks something else - the architecture is actively fighting you
- The schema needs fundamental structural changes: multi-tenancy, wrong entity relationships, missing core abstractions
- Bolt context drift has made the codebase inconsistent throughout
- The audit finds that most of the app needs replacing

**When unsure:** Start with a [Security Audit](https://zeroic.in/services/ai-audit). It starts at $1k, takes 1-2 weeks, and produces a ranked findings report before you commit to either path. Most of the time it confirms a rescue. Sometimes it finds the structural problem that would have sunk a rescue six months in, and that’s worth knowing before you spend $6k. Running the audit first is always cheaper than guessing wrong.

## What 100+ audits and FormulaBot’s growth to 1.5M+ users taught us

We’ve run over 100 [audits](https://zeroic.in/audits) across Bubble, Supabase, and vibe-coded stacks. The consistent finding: most founders who think they need a full rewrite have a problem a rescue can fix, and a rescue keeps the product logic their users already know. A full rewrite is the right call in a minority of the cases where founders arrive convinced they need one.

The closest parallel in our own work is [FormulaBot / Better Analyst](https://zeroic.in/formulabot). It didn’t start vibe-coded, but since we embedded in 2023 it has faced the same fork at every growth stage: harden what exists, or rebuild it. The monolith-to-services migration - splitting AI inference, data processing and the user-facing API into independently deployable services - came when the architecture had to change for the next jump in scale. That work is what let the platform grow from thousands to 1.5M+ users on the same product. Rescue first, rewrite only when rescue stops being enough.

The rest of our [Code Rescue work](https://zeroic.in/work) follows the same pattern. Lovable apps usually need the full auth-hardening pass before they’re safe to give an enterprise customer. Cursor apps tend toward surgical scope - specific N+1 fixes, migration order fixes, targeted hardening. Bolt apps are the variable case: small ones rescue cleanly, but past the 15-20 components where Bolt’s context retention starts to slip, the drift often tips it toward a partial or full rebuild. We make that call in the 3-day review, before any rebuild work starts.

## Frequently asked questions

**How much does a Code Rescue cost compared to a full rewrite?**

A Code Rescue starts at $6k and takes 2-4 weeks, beginning with a 3-day review. A clean-slate rebuild through our MVP Sprint starts at $12k for 5-6 weeks, and at least one rescue vendor puts larger rewrites at $25k+ over 8-16 weeks. The bigger cost of a rewrite is the weeks when no new features ship, which hurts most for a pre-Series A company.

**Can a Code Rescue fix a broken data model?**

No. If the app needs multi-tenancy where none exists, or the core entity relationships are wrong, a rescue can't unwind that without effectively becoming a rewrite. This is the clearest signal that a rescue won't hold: the schema needs structural changes, beyond adding missing indexes or soft-delete columns.

**Do I need an audit before committing to rescue or rewrite?**

In most cases, yes. What founders describe as 'the app is breaking' and what's wrong underneath are often different things. A Security Audit (from $1k, 1-2 weeks) produces a ranked findings report before you commit to either path. Most of the time it narrows the work to a targeted rescue. Sometimes it surfaces structural issues that would make a rescue fail six months later anyway.

**At what user count should I start thinking about a rescue?**

Don't wait for a user count. The signals are architectural: auth policies missing, N+1 queries in your most-used flows, no error tracking. These are risks from user one. The practical deadline is before you sign your first enterprise customer, before you take on regulated data, and before any funding round where technical due diligence is on the table.

**Can a Code Rescue handle a Bolt app with many components?**

It depends on how far the code has drifted. On larger Bolt projects, each new prompt works with partial memory of earlier decisions, so the same thing gets done three different ways. While fixes stay local, a targeted rescue works. Once fixing one area keeps breaking another, a partial or full rebuild is more efficient.

## References

1. [CVE-2025-48757 - Lovable RLS Vulnerability (Matt Palmer)](https://mattpalmer.io/posts/2025/05/CVE-2025-48757/)
2. [SecurityOnline: CVE-2025-48757 exposes sensitive data across Lovable projects](https://securityonline.info/cve-2025-48757-lovables-row-level-security-breakdown-exposes-sensitive-data-across-hundreds-of-projects/)
3. [CodeRabbit: State of AI vs Human Code Generation Report](https://www.coderabbit.ai/blog/state-of-ai-vs-human-code-generation-report)
4. [Supabase Row Level Security documentation](https://supabase.com/docs/guides/database/postgres/row-level-security)
5. [PostgreSQL documentation: Constraints (foreign keys)](https://www.postgresql.org/docs/current/ddl-constraints.html)
6. [Dupple: Bolt review (context retention past 15-20 components)](https://dupple.com/reviews/bolt)
7. [Convergex AI: Fix my vibe-coded app - rescue, don't rewrite](https://www.convergexai.com/blog/fix-my-vibe-coded-app-rescue-dont-rewrite-1)

#code-rescue#vibe-coding#lovable#bolt#mvp#founders

More from the journal

[ For founders

## [Fixed-price MVP development: the scope discipline that makes it work](https://zeroic.in/blog/fixed-price-mvp-development)

What has to be true about the scope for a fixed-price MVP to work, what it costs in 2026, and the red flags in any fixed quote.

Khushi Arora Sep 28, 2026 · 7 min read

[ For founders

## [Senior engineer retainer vs. full-time hire: the real math (2026)](https://zeroic.in/blog/senior-engineer-retainer-vs-hire)

What a US senior hire costs in year one, line by line, next to a retainer - and the four cases where hiring full-time still wins.

Khushi Arora Sep 26, 2026 · 7 min read

[ AI development

## [GPT vs Claude vs Llama in production: choose by task type](https://zeroic.in/blog/gpt-vs-claude-vs-llama-production)

Four kinds of LLM work, the model tier that wins each one, and the volume at which running open weights yourself starts to make sense.

Prashant Abbi Sep 29, 2026 · 8 min read

## Hear from Khushi within 24 hours.

**Khushi Arora** Partner @ Zeroic

Not sure if your app needs rescue or a full rebuild? A Security Audit (from $1k, 1-2 weeks) tells you exactly what's broken and which path makes sense - before you commit to either. We've run 100+ audits on Bubble, Supabase and vibe-coded apps.

[Start with an audit](https://zeroic.in/services/ai-audit), or [book a 30-minute call](https://zeroic.in/book)

Pages [Services](https://zeroic.in/services) [Work](https://zeroic.in/work) [Blog](https://zeroic.in/blog) [About](https://zeroic.in/about) [Book a call](https://zeroic.in/book)

Services [Audits](https://zeroic.in/services/ai-audit) [MVP Sprint](https://zeroic.in/services/mvp-development) [Retainer](https://zeroic.in/services/senior-developers) [Code Rescue](https://zeroic.in/services/code-rescue) [Bubble to code](https://zeroic.in/bubble-to-code) [AI development](https://zeroic.in/ai-development-company)

Contact [Email](mailto:zeroic.in@gmail.com) [WhatsApp](https://wa.me/919873927225) [LinkedIn](https://www.linkedin.com/company/zeroic/) [X (Twitter)](https://x.com/PrashantAbbi) [Guide for AI](https://zeroic.in/llms.txt)

© 2026 Zeroic [Privacy](https://zeroic.in/privacy) [Terms](https://zeroic.in/terms)

Built in India · Shipping globally

SINCE