Ingest, Diagnose, Fix, Harden, Deploy: How the Pipeline Works

That's how you built your app, and the practice even has a name: computer scientist Andrej Karpathy called it "vibe coding" in February 2025. You're in good company. Gartner projects that by 2028, 75% of enterprise software engineers will use AI code assistants, up from less than 10% in early 2023. Your app demos well, a few users have signed up, and on a good day it feels ready to go.

Then reality knocks. A prototype that runs is not a product that survives real traffic, real payments, and real attackers, and vibe-coded apps tend to hide the same gaps: no error handling, secrets sitting in plain sight, no tests, and security holes nobody reviewed. It's a house staged for the listing photos: gorgeous in the frame, no wiring behind the walls. Veracode's 2025 GenAI Code Security Report found that 45% of AI-generated code carries a security flaw. So you hit an expensive fork: rewrite the whole thing from scratch, hire a contractor for months, or ship what you have and quietly hope it holds.

There's a better question than which of those three to pick. How do you finish the last twenty percent — the stretch between "it demos" and "it's in production" — without throwing away the eighty percent that already works?

The five stages run in strict time order, and the sequence is the point: each stage consumes what the stage before it produced, so none can be skipped or reordered.

01Ingest

Ingest maps what you already have so nothing gets rebuilt blindly.

• It pulls in the entire codebase, its dependencies, and its configuration, rather than sampling a handful of files.
• It traces how the pieces connect, so a change in one spot reveals its blast radius everywhere else.
• And it records a baseline of how the app behaves today, so every later change can be measured against what already worked.

Ingest draws the map; the rest of the pipeline drives on it.

02Diagnose

Diagnose finds the specific defects keeping your app out of production.

• It scans for security holes — exposed secrets, missing authentication, unsafe handling of user input.
• It flags reliability gaps — unhandled errors, missing validation, code paths with no tests.
• And it ranks every finding by severity and blast radius, so the list reads as a priority order rather than an undifferentiated pile.

Diagnose turns a vague unease about quality into a concrete, ordered list of what's actually wrong.

03Fix

Fix repairs those defects in place instead of rewriting the codebase.

• It touches only the code tied to a specific finding, leaving alone everything the diagnosis found healthy.
• It preserves the working eighty percent, because the goal is to finish this app, not start another.
• And it re-checks each change against the baseline from ingest, so a fix that quietly breaks working behavior gets caught before it moves on.

Fix closes the diagnosed defects one by one, in priority order, with no rewrite.

04Harden

Harden adds the production safeguards a prototype never had.

• It moves secrets out of the code and into managed configuration, so credentials stop traveling with the source.
• It adds the controls real users demand — input validation, authentication, rate limiting — at the app's edges.
• And it wraps automated tests around the critical paths, so the next change you make can't silently undo this one.

Harden is where an app that merely works becomes an app that can safely take load.

05Deploy

Deploy ships the result with the power to watch it and roll it back.

• It releases through a repeatable process, so shipping is a routine step rather than a white-knuckle manual event.
• It switches on monitoring and error tracking, so you hear about problems from your dashboards instead of from angry users.
• And it keeps a rollback path ready, so a bad release is reversed in minutes rather than endured for hours.

Deploy closes the pipeline by making production a place you can operate, not just reach.

Read the five stages together and the shape of the answer is plain: you don't have to choose between a rewrite, a contractor, and crossed fingers, because the work between a demo and a product is a finite, ordered list of defects you can find and close on top of the code you already have. The eighty percent that works is an asset, not a liability. The last twenty percent is a checklist, not a mystery.

To put the pipeline to work on your own app, take these steps in order.

1. 01

   Inventory the app

   point the pipeline at the full codebase, its dependencies, and its configuration, and let it build the map.

2. 02

   Run a diagnostic pass

   generate the ranked list of security and reliability defects, and read it top to bottom.

3. 03

   Fix and harden down that list

   close each defect in place, add the missing production safeguards, and check every change against your baseline.

4. 04

   Deploy behind monitoring

   release through a repeatable process, switch on error tracking, and confirm your rollback path works before you need it.

Start with the inventory this week. It's the cheapest step, it commits you to nothing, and it converts the anxious question — rewrite, contractor, or hope — into a concrete list you can actually finish.