What it costs to rescue an AI-built app in the UK

Start with the audit, the only part anyone can price before reading the code. First-look prices for an AI-built app run from £250 to £4,500 across six providers we checked, and ours is a fixed £3,500. After it, hardening usually takes two to four senior engineer weeks and a refactor six to twelve. A single-workflow rebuild costs what a new build does: £35,000 to £80,000 on our published band.

Rescuing an AI-built app means taking code that nobody has fully read to the point where someone can answer for it in production, starting with an audit and ending in hardening, a refactor or a rebuild.

Every figure below is either a price another firm advertises, with the firm named and the dates we checked it (26 and 28 October 2026), or one of our own published prices or bands. Hardening and refactoring are counted in senior engineer weeks and left unpriced, because the weekly rate is the supplier's to state. Multiply the weeks by the rate you are quoted.

Four shapes, counted in weeks

A rescue takes one of four shapes, and the audit decides which. The table counts effort in senior engineer weeks, with a price only where we publish one.

Engineer weeks are not calendar weeks. Engineers working in parallel shorten the calendar, though never in proportion, because some of the work can only happen in order. A rebuild is the exception in this table: its six to twelve weeks are calendar weeks, as for any MVP.

The refactor and rebuild rows sit close together, the most useful fact in the table. A refactor deep enough to replace the data model is most of an MVP's work again, so it costs about what starting again costs. The choice turns on what is worth keeping. The criteria for that call are in harden, refactor or rebuild an AI-built app.

The audit is the cheapest line, so buy it first

First-look prices run from £250 to £4,500, which is reason enough to ask what each one includes. We read six providers' pages on 26 October 2026 and again on 28 October 2026, and recorded what each advertises. No price had changed between the two readings. VibeRescue does not say where it is based, and the other five are UK firms.

Taking each provider's audit-type offer, the middle one is about £1,000. The £4,500 at the top is Rocking Tech's discovery sprint, not an audit, and the same firm quotes builds from £25,000. These are the prices each firm advertised on those dates, and they move, so check the page before you rely on one.

Ask what the price buys. An automated scan finds exposed keys, missing access rules and packages with known flaws, which is worth having, and it will not tell you whether the data model survives a second customer. A person reading the code and writing down a plan costs more because it takes days where a scan takes minutes. What we check first in an AI-built app is a list to hold any of them against.

Ours is £3,500, fixed, which is above the middle of those offers. It pays for a senior engineer reading the code, the access rules and the money paths, plus a UK GDPR review of where your users' personal data goes.

After the audit, a hardening sprint on an AI-built app orders its work the way our audits against a platform's written architecture do: data integrity first, documentation last. The drift it closes matters beyond the app: code that no longer matches its own architecture document is one of the first things a diligence reviewer probes.

Hardening: two to four weeks inside the existing architecture

Hardening fits when the data model is sound and the app has one kind of customer. The work is a list of specific fixes. Access policies are written for every table that holds customer data and checked from a second login, and keys are moved out of the browser and rotated. Validation is repeated on the server, sign-in settings are tightened, a backup is restored somewhere harmless, error reporting reaches a person, and anything that moves money gets tests.

None of it is glamorous, and all of it becomes urgent the day strangers can sign up. The person who built the app is also the person least likely to see the gaps. In a Stanford study, developers using an AI code assistant wrote measurably less secure code than those working without one, yet were more likely to believe their code was secure (Perry et al., 2023). It was a small study, mostly of students, with an assistant from 2022, so read it as a finding about confidence. Misplaced confidence is what a second reader is there to catch.

Speed matters more than it used to. UK government guidance now tells public-sector teams to assume AI will shorten the time between a flaw existing and being exploited, and to set patch deadlines accordingly (GDS and DSIT, 2026). It was written for government code. The reasoning holds for anyone with a login page.

Refactor: the data model stays, the plumbing goes

A refactor keeps what users see and what the database knows, and replaces the layers that cannot carry more customers: tenancy, authorisation, payments, and the boundary between the browser and the data. Six to twelve engineer weeks is typical, and tenancy is usually what pushes it towards the top.

Much of a refactor's cost comes from doing it while customers use the app. On a coaching platform we build, any release that changes the shape of stored data goes out in a fixed order. The code goes first, then the database change, then the search index rebuilt from the database. Records written before the change carry an empty value for the new field until the rebuild reaches them, and checks that refuse by default would otherwise turn away every older record in that window. An AI-built app changing its data model under paying customers needs the same discipline, which is why a refactor's estimate grows with every live customer.

Tenancy enforced by construction is the standard we build our clients' platforms to, and it is the standard a vibe code rescue gets measured against when we take one on. Payments are the other large line. Moving from a hosted checkout link to payments that cope with refunds after payout, retried webhooks and reconciliation takes weeks on its own. Make the billing decisions that are hard to reverse during a refactor, because they are cheaper then than after it.

Rebuild: priced like the new product it is

A rebuild is an MVP, and the old code does not earn it a discount: £35,000 to £80,000 over six to twelve weeks for a single workflow built to production standard. What it keeps is worth more than code: the product decisions the prototype proved, the users and their data, and a specification you can write by watching people use the first version. Of everything in the prototype, the code is the cheapest thing to lose.

Rebuilds of platform shape, with a second user type, payments or an offline app, sit in the bands we publish on our case studies. They run from £90,000 to £140,000 for a core build of about fourteen weeks by a small senior team. For a larger platform with an offline mobile app they reach £150,000 to £250,000 to first release. Inside a band, the migration of live data and the date of the cut-over usually decide where a rebuild lands.

What moves the price of a rescue?

Whether the data model is worth keeping decides the shape before anything else, which is why the audit comes first. After that, six things move the price, roughly in this order.

Live users make every change slower, because each fix has to ship in smaller steps with a way back and every migration has to run against real records without losing any.

Money in the flow adds weeks: refunds after a payout, failed renewals, and a ledger that reconciles.

Health or other special-category data adds the work of settling a lawful basis and deciding what may enter a prompt, which the health-data questions to settle first walk through.

No tests means writing characterisation tests before changing anything, usually a week or two, so the rescue does not break what already works.

Exposed keys have to be rotated, because deleting them leaves the old ones in the repository's history.

The last lever is on your side of the table: how quickly somebody can answer "what is this supposed to do?". A founder who answers within the day takes weeks off a refactor. Staying on Lovable, Bolt.new or Supabase, by contrast, is rarely what makes a rescue expensive.

Common questions

How much does fixing a vibe-coded app cost in the UK?

Six providers advertise first-look prices from £250 to £4,500 (checked on 26 and 28 October 2026), and ours is a fixed £3,500. Hardening that keeps the architecture is two to four senior engineer weeks, a refactor is six to twelve, and both are priced after the audit. Rebuilding a single-workflow product costs what a new MVP does: £35,000 to £80,000.

Is it cheaper to rebuild an AI-built app than to fix it?

Rarely, if the data model holds up: hardening wins. Once the data model or the tenancy has to change, a refactor costs about as much as a rebuild, and the rebuild carries less baggage. What decides it is what is worth keeping, and only somebody reading the code can tell you that.

Why do first-look prices range from £250 to £4,500?

Because different products share the name. A scan for exposed keys and missing access rules can be sold cheaply. A person reading the data model, the permissions and the money paths, then writing a plan, takes days, and a discovery sprint takes weeks. Ask which a price buys: you want the scan either way, and the reading before money moves.

Do I have to move off Lovable, Bolt.new or Supabase?

Not in most cases. Hardening mostly happens where the app already lives: policies in the database, keys moved to the server, tests and backups added around what exists. Moving is worth it when the platform blocks something the business needs, such as background processing, a compliance requirement, or a stack your next engineer cannot work in.