What is AI slop in code?
AI slop is output that looks finished but is low quality underneath. In code it shows up as comment bloat, try and catch blocks around everything, three helpers that do the same thing, dead code from abandoned attempts, packages that are installed but never used, and tests written to pass instead of to check anything.
The riskier kind is plausible but wrong code: an API call to a method that does not exist, a permission check that never runs, a database rule that allows every user to read every row. Deslopping, or unslopification if you like the longer word, is removing that layer and leaving code that does one thing in one place.
Why AI-generated code falls apart as your project grows
An AI coding tool only sees what fits in its context window. On a small project that is the whole app. As the project grows, each prompt sees a smaller slice of it, so the AI repeats code that already exists somewhere it cannot see, breaks a flow it did not know about, or contradicts a decision made three weeks earlier. Models also get less reliable as the context fills up, an effect known as context rot.
The result is architectural drift. Every session makes a reasonable choice on its own, and together they add up to four ways of handling errors, two ways of calling the API and three date formats. That is the point where each fix breaks something else and the AI starts going in circles.
Comprehension debt: code that nobody on the team understands
When people write code, understanding it comes as a side effect. When AI writes it faster than anyone can review it, the codebase grows past what the team actually knows. That gap is comprehension debt, and it is paid the day something breaks in production and nobody can explain how payments, permissions or emails work.
Paying it down means reading the code, writing down how the main flows work, deleting what is not used and putting tests around what matters, so the next developer, or the next AI session, starts from solid ground.
Security risks in vibe-coded apps
The most common findings in AI-built apps: API keys and secrets in frontend code or in the repository, Supabase row level security turned off or Firebase rules open to anyone, permission checks that exist in the screen but not in the backend, input that is never validated, and AI or payment API keys with no spending limit.
There is also slopsquatting. AI tools sometimes suggest packages that do not exist, and attackers register those names with malicious code. A cleanup checks every dependency, removes what is unused or unknown and replaces abandoned libraries.
Signs your vibe-coded app needs a rescue
Every fix breaks something else. The AI keeps rewriting the same file without solving the problem. Nobody wants to touch payments or login. Deploys are manual and scary. Pages got slow as the data grew. The hosting or AI bill jumped and nobody knows why. A developer you hired took one look and suggested starting over.
Any one of these is a reason to get a code review before adding the next feature on top.
Should you fix or rewrite an AI-built app?
Usually fix it. A rewrite throws away what already works and brings back the same risks. The code review shows which parts are sound, which need refactoring and which, if any, are cheaper to replace.
When replacing a part is the better option, it is done in stages while the current app stays online, so your users do not wait for a big switch.
How the cleanup works
It starts with a code review: architecture, security, data model, dependencies, performance, tests and deployment. The result is a list of problems ranked by risk and a first cycle shaped around the most urgent ones.
The work then runs in fixed 6-week cycles, in order of risk: secrets and API keys, login and permissions, database rules and data, input validation, tests around critical flows, deslopping and refactoring, then a reliable deploy. Each cycle ends with the improvements in production and the conventions written down for your team and your AI tools.
Which AI tools and stacks do you work with?
Apps generated with Cursor, Claude Code, GitHub Copilot, Lovable, Bolt, Replit, v0 and ChatGPT. Most of them produce React, Next.js or Node.js code on top of Supabase, Firebase or PostgreSQL, the same stack DevLunch builds with every day, along with Ruby on Rails and React Native.
If the code is not in a repository you own yet, it is moved there first, with separate environments for development and production.
How much does it cost to fix AI-generated code?
DevLunch does not bill by the hour. The work is priced per fixed 6-week cycle, with price and deadline set before development starts. You decide after each cycle whether to continue.
