What it costs to rescue a vibe-coded app in 2026

The call usually starts the same way. Somebody built an app with AI tools last year, faster and cheaper than they thought possible. It launched, it got users, and for months everything was fine. Now the payment provider is flagging retries nobody can explain, or an investor's tech advisor is asking who audited the codebase, or the last three deploys each broke something unrelated. The person on the phone doesn't want a lecture about AI. They want to know what fixing it costs.

We wrote last winter about the Month 3 Problem: vibe-coded apps tend to work right up until you need to change them. Enough companies have hit that wall that fixing the aftermath is now its own service line, with its own name (rescue engineering) and a growing market of specialist shops. Industry write-ups claim that of the roughly 10,000 startups that shipped AI-built production apps by late 2025, some 8,000 have needed rescue work since, at $50,000 to $500,000 a job. Those figures come from people selling cleanup services, so season to taste. But the shape matches what lands in our inbox.

The honest answer to the cost question is a set of tiers, not a number. Here they are, with what you get at each level, and the five signals that tell you which one you're actually in.

Why rescue became a service category

The clearest data on what AI code does over time comes from GitClear, which analyzed 623 million changed lines of code from 2023 through 2026. Duplicated code blocks are up 81 percent since 2023, the highest level on record. Refactoring, the unglamorous work of restructuring code as a product grows, collapsed from 13 percent of changed lines to under 4. Constructs that hide errors instead of handling them are up 47 percent. Developers with AI assistants now paste roughly five times more often than they restructure.

None of that stops an app from working on launch day. It decides what happens when you try to change it. Duplicated logic means a bug fixed in one place stays alive in four others. Error-masking means the app looks healthy while it quietly corrupts data. This is why rescue calls come months after launch rather than weeks. The code didn't rot. It was always like this, and growth exposed it.

Security is the harder edge. Veracode's Spring 2026 testing found that 45 percent of AI-generated code fails basic security checks, a rate that hasn't improved in two years even as the models got dramatically better at producing code that runs. Georgia Tech researchers counted 35 CVEs traced to AI coding tools in March 2026, up from six in January. And about a fifth of generated samples reference software packages that don't exist, which attackers exploit by registering the hallucinated names and filling them with malware.

The four tiers, with numbers

Rescue quotes vary the way build quotes do. But after enough of these projects, the work sorts itself into four tiers.

Audit: $3,000 to $15,000

One to two weeks, read-only. You get a map: what the code actually does, where the dangerous parts are, what fixing them would cost, and, just as useful, what's fine as it is. Plenty of vibe-coded apps pass with a short repair list. An audit is also what an investor's technical advisor will run during due diligence anyway, so commissioning one before the fundraise means you control the timing and the narrative. Independent audit shops price small and mid-sized codebases from a few thousand dollars; enterprise due diligence engagements go far higher, but that's a different animal.

Stabilize: $15,000 to $60,000

The most common tier. The code stays; the risk goes. Tests get written around the paths that touch money and login first, because those are the ones that end up in incident reports. API keys that were committed to the repository get rotated. Hallucinated and abandoned packages get replaced with real ones. Failures that used to be silent become logged and monitored. Four to eight weeks for most small products, and at the end, deploys stop being frightening. That's the actual deliverable.

Partial rebuild: $60,000 to $150,000

For when specific subsystems are past saving. Usually it's auth, payments, or the data layer: the parts that can hurt you. They get rebuilt properly and swapped in while the rest of the app keeps running, so users never see it happen. This is the tier for products with real traction whose foundations weren't built for it. The product is right. Parts of the implementation aren't.

Full rebuild: $150,000 to $500,000

The tier nobody wants. It happens when the data model itself is wrong and everything is coupled to it, or when there's an active security problem and the remediation has to double as incident response. The typical profile is an app that grew for eighteen months on its original generated foundation. At this level the fix costs more than building it correctly would have, which is the trap in one sentence: the money saved in month one gets repaid at the top of the range in month eighteen.

Five signals that tell you which tier you're in

You can't scope your own rescue precisely. You can get close with five questions.

• Can anyone explain how login works? Not whether it works. Whether someone can explain it. Auth code nobody understands should be treated as wrong until audited.
• Where do the secrets live? API keys committed to the repository puts you at stabilization, minimum. If that repository was ever public, you're not scoping a project anymore. You're responding to an incident.
• Is the data model worth saving? If the core entities are roughly right, most of the app can be saved around them. If they're wrong, every future feature is a small rebuild in disguise, and the honest move is one big one.
• Are there tests? Zero tests is normal for vibe-coded apps and isn't fatal. It's just always the first line of the invoice.
• Is real money flowing through it? Users and revenue raise the stakes of every defect. As a rule of thumb, they move you up one tier from wherever you thought you were.

Call while it's still a choice

None of this is an argument against AI coding tools. We use them every day. The argument is against unreviewed output compounding in production for a year, because that's the variable that moves you across tiers. Not whether AI wrote the code. How long nobody looked at it.

If your app works and is growing, that is exactly the moment an audit is cheap. A few thousand dollars while things are calm buys you the repair list and control of the timing. The expensive version of this conversation starts after the incident, and by then the tier has already been chosen for you.