How Much Does It Cost to Turn an AI-Built Prototype Into Production Software

A working prototype is not a product. That gap is where most AI-built apps die, and where most budgets blow up. A founder prompts Cursor or Lovable over a weekend, demos something that logs in and queries a database, then discovers over the following month that auth is enforced in the browser, the schema has no migrations, nothing is tested, and the deploy script is a single person pushing to Vercel from a laptop.

The question that follows is almost never asked up front: what does it actually cost to finish the job? Most buyers price the prototype and forget the second mile. The second mile is where the money is.

This piece walks through the real line items — auth, data model, tests, CI/CD, observability, and security remediation — with hour ranges and dollar figures so you can budget it before, not after.

Why the Second Mile Is Where the Money Is

The ratio most teams miss is not subtle. One studio puts it plainly: the first 80% of functionality takes 20% of the effort, and the remaining 20% — making the thing safe, observable, and reliable — takes the other 80%. A prototype built in a weekend typically needs two to four weeks of focused work before it holds up to real users.

The security data backs that up. A peer-reviewed study of 1,186 vulnerabilities across publicly deployed vibe-coded apps found that 91% of applications contained at least one vulnerability, and 65.77% were rated Critical or High, concentrated in broken access control, injection, and authentication failures. Separately, Carnegie Mellon measured AI-generated code and found 61% of it was functionally correct but only 10.5% was secure. The code runs. It is not safe.

At US senior rates — a median of $68/hour for a senior and $76/hour for a strong senior in Q3 2026, or $110–$160/hour through a boutique US agency — the hardening phase typically lands between $8,000 and $45,000 depending on scope. That is the number worth planning around. If the full build has to be rebuilt from scratch (because the generated code has no architecture to extend), budget doubles. Our breakdown of rehost, refactor, or rebuild tradeoffs covers the same decision in a modernization context.

Auth and Access Control Is Almost Always Rebuilt

Auth is the single most common cause of post-launch incidents in AI-built apps. The failure mode is specific: the prototype checks a user role on the frontend, hides a button, and considers the job done. The API accepts anything. One scan found a case where users changed a single browser value to unlock all paid features within 72 hours of launch.

Fixing this is not optional and it is not fast. Expect:

• Server-side middleware on every protected route (8–16 hours). Every handler gets an auth guard. Nothing ships without one.
• RBAC or ABAC model, migrated into the DB (12–24 hours). Roles, permissions, and resource ownership become data, not code paths.
• Session management, token rotation, password reset flows (16–32 hours). Prototypes usually stub these. Production does not.
• Row-level security or tenant scoping (16–40 hours), especially on Supabase. If the app serves more than one customer, review our notes on multi-tenant data isolation.

Call it 50–110 hours of senior work. At US agency rates that is $5,000–$17,000. If the app touches money or regulated data, the ceiling goes up, not down.

The Data Model Usually Needs a Second Pass

AI-generated schemas tend to be flat, missing indexes, missing foreign keys, and short on constraints. There are no migrations because the AI created tables through the Supabase console. Nothing in version control describes the current state of the database.

The work here is unglamorous and real: write migrations that reproduce the current schema, add the indexes the query planner needs, add foreign keys and NOT NULL constraints the AI omitted, normalize the two or three tables that will become hot, and introduce a seed fixture for local development. Budget 30–80 hours. A moderately complex SaaS schema with ten to twenty tables lands near the top of that range.

If the generated code uses an ORM poorly — N+1 queries in list endpoints, no connection pooling, no pagination — expect another 20–40 hours of query work before load testing passes.

Tests, CI/CD, and Observability Are Rarely Even Started

Most AI-built prototypes have zero tests. Not few. Zero. The prompt-to-feature loop never produced any, and the founder never asked. What production needs is modest but non-negotiable:

• A test suite that runs on every push (24–60 hours). Four to eight end-to-end tests covering signup, the core user flow, payment, and admin. Unit tests on the three or four modules with real logic.
• CI pipeline with lint, type-check, test, and deploy stages (12–24 hours). GitHub Actions or similar. Preview deploys per PR.
• Structured logging, error tracking, and uptime monitoring (16–32 hours). Sentry or equivalent, log aggregation, a dashboard that answers "is it up and how slow is it right now."
• Runbooks and on-call basics (8–16 hours). Who gets paged, how a rollback happens, where the DB backup lives.

That is 60–130 hours, or roughly $6,000–$20,000 at US agency rates. Teams that skip this part do not save money; they pay it later, usually at 2am. Our walkthrough of auditing AI-generated code covers what to look for before any of this starts.

Security Remediation Is Priced by Findings

Security is where ranges get wide, because they depend on what the scan turns up. One third-party pentest of vibe-coded apps found that missing rate limiting and resource exhaustion accounted for 93 of 434 exploitable issues, with broken authorization and IDOR second at 88, and SSRF-class flaws third at 54. A typical remediation list for a mid-sized AI-built app runs:

• Secrets rotation and vault migration (4–8 hours). Every key in the repo or in a .env on the server is burned.
• Input validation and output encoding across all endpoints (20–40 hours).
• Rate limiting, bot detection, and DoS protection (12–24 hours).
• Dependency audit and upgrade cycle (8–24 hours). Generated code pulls in a lot of packages, and Veracode measured failure rates above 70% for Java and 38–45% for Python, C#, and JavaScript in AI-generated code vulnerability scans.
• SAST, DAST, and a manual review pass (16–40 hours).

Call it 60–135 hours — $6,000–$20,000. If the app handles PII or payments, add a formal pentest ($8,000–$20,000 fixed) on top. For agentic systems that touch internal data, the ceiling is higher still; our write-up on approvals, audits, and RBAC for AI agents covers the extra controls.

What the Full Number Looks Like

Add it up for a typical B2B SaaS prototype built on Lovable or Bolt and brought to production by a US team: 200–450 hours of senior engineering, landing at roughly $20,000–$55,000 all-in. Simple internal tools come in lower. Anything with payments, multi-tenancy, or compliance comes in higher. A rough sanity check from the broader market puts the median "AI-generated MVP polished for production" at $4,800 for a freelancer path and $12,000–$30,000+ for an agency rebuild, with the AI doing 30–40% of the work and a human the rest.

Three things change the number more than anything else:

1. Whether the generated code can be extended or has to be rewritten. If the AI produced a single 4,000-line component with no separation of concerns, the "hardening" project is actually a rebuild. The prototype still earned its keep as a spec.
2. Whether the data model survives. Keeping the schema and migrating around it saves weeks. Replacing it means replaying every user interaction.
3. Who signs off on security. A founder-only review is cheap and risky. A real pentest costs money and finds things.

If you want a sharper number for your specific prototype, the ingredients are the same ones any custom software RFP should list: current stack, lines of code generated, number of user roles, number of integrations, data sensitivity, and target uptime. Our AI development team scopes this work on fixed quotes once those are in hand.

Budget the Second Mile Before You Start the First

The cheapest way to productionize an AI-built prototype is to assume from day one that you will. Build the demo knowing an engineer will take it from there. Keep prompts narrow, keep the schema sane, do not let the AI invent its own auth scheme, and version-control everything the tool will let you export. The prototype is the specification. Treat it that way and the second mile shrinks. Treat it as the product and the bill arrives later with interest.