What Does It Cost to Secure a Vibe-Coded App?

If you built an app with AI and you are wondering what it costs to make sure it is safe, here is an honest breakdown with no sales pitch in it. What checking costs, what fixing costs, when it is worth paying, and when you can handle it yourself for nothing.

Step 1. Finding out whether you have a problem: free

Nobody should pay to find out whether there is something wrong. You can do a lot of this yourself with the checklist, and most people are capable of it. If you would rather have someone look, a half-hour call with an engineer who has already been through your app costs nothing and tells you where you stand. If your app turns out to be fine, that is a perfectly good outcome.

Step 2. Getting the dangerous parts fixed: around €1,450

This is the one most people need. Somebody goes in and closes the things that put your users at risk: an open database, keys sitting in your public code, a login that does not really check anything. For a small AI-built app that is roughly a week of work, and it should be a fixed price you agree before anyone starts. Shipworthy charges €1,450 for it. If someone quotes you an hourly rate with no ceiling for work this well understood, be careful.

Step 3. Making it genuinely ready: around €3,900

The step above makes your app safe. This step makes it reliable: it keeps working when a lot of people arrive at once, it gets backed up so a bad day is not the end of your business, and it raises an alarm when something breaks instead of leaving you to find out from an annoyed customer. Two to three weeks for a small app, typically a few thousand. Again, fixed and agreed up front.

Step 4. Keeping someone around: €600 to €1,500 a month

Optional, and genuinely not everyone needs it. If your business would suffer from being down for a day, having an engineer on standby costs a few hundred a month for working hours, or more for someone who answers at three in the morning. Think of it the way a shop thinks about a locksmith's number on the fridge.

When it is worth paying, and when it is not

• Doing it yourself makes sense when nothing serious turns up, or the issues are simple and you are comfortable following the checklist.
• Paying makes sense when real user data is at stake, when the findings are beyond what you want to attempt, when you are about to launch or raise money, or when you would simply rather someone else was responsible for getting it right.

The cost of doing nothing

This is the number people forget. A breach is not only embarrassing. If personal data leaks you may have legal duties to notify people, and fines (GDPR penalties run well into five figures and beyond), you lose trust that is very hard to win back, and you end up paying for cleanup at emergency prices. And an unprotected endpoint that calls a paid service can quietly turn a small bill into an enormous one over a weekend. Measured against that, a fixed few thousand is the cheapest insurance you will ever buy.

How to find out where you stand

Send me your app's address. I will go through it myself before we speak, and then we take half an hour and I tell you what I found in normal words. It is free, there is no pitch at the end of it, and if your app is in good shape I will say so.