Handing Off Your AI Prototype to an Agency: The Checklist

TL;DR. A prototype built in Bolt, Lovable, v0, Cursor, or Replit doesn't explain itself — AI-generated code hides intent, and a large share of it hides vulnerabilities too. Before you hand yours to an engineering partner, prepare five things: an honest inventory of what actually works, transferable access to every account and secret, the context the code doesn't carry, a scoped definition of "production-ready," and a red-flag check in both directions.

What an AI Prototype Handoff Actually Is

An AI prototype handoff is the transfer of a working (or half-working) AI-generated codebase — plus its accounts, secrets, data, and undocumented intent — from the founder who prompted it into existence to the engineering partner who will make it production-grade. It is not a design handoff. Search "prototype handoff" and you'll find Figma-to-developer guides about redlines and spacing tokens — all assuming the code doesn't exist yet. Yours does.

The handoff is harder than it looks for one structural reason: nobody fully wrote your code. You prompted it, the model generated it, and you accepted whatever ran. The result is a codebase full of decisions no human made deliberately. Per Veracode's Spring 2026 GenAI Code Security report, 45% of AI-generated code contains security vulnerabilities even when it's syntactically near-perfect. When Symbiotic Security scanned 1,072 vibe-coded Supabase apps, 98% had at least one vulnerability and 16% had critical ones. This is why any competent partner will review your code before quoting — and why the security side of the handoff has its own 18-point checklist.

Everything below is what happens before the engineering starts: five phases, from inventory to red flags.

Phase 1: Know What You Actually Have

Most founders can't answer basic questions about their own prototype. Answering them before you contact anyone is the difference between a sharp fixed-price quote and weeks of paid discovery.

• Name the tool and its export status. Bolt and Lovable can sync to GitHub; some platforms keep hosting and database inside their walls. Know whether your code lives in a repo you control or inside the platform.
• Clone the repo fresh and run the build. If npm install && npm run build fails on a clean machine, your partner's first billable day gets spent discovering that. Better you discover it.
• Locate the database. A Supabase project you own? A platform-managed database you've never logged into? Is there real user data in it — because that carries GDPR obligations the moment you share access.
• Separate real from mocked. AI prototypes are full of hardcoded arrays, fake "success" states, and buttons wired to nothing. List which is which.
• List the flows that genuinely work end-to-end. "Works" means works from a fresh account, not from the one state you always test in.

The deliverable is a one-page inventory. It takes an evening and saves days of paid archaeology.

Phase 2: Access and Ownership

The fastest way to stall an engagement is access that arrives piecemeal over weeks. The second fastest is secrets pasted into email. Prepare all of it before day one.

• Repo access. Invite your partner as a collaborator on your GitHub org. Never zip the code and email it — you lose history and reviewability.
• Environment variables and secrets. Inventory every key: Stripe, Supabase, OpenAI/Anthropic, email provider. Share them through a password-manager shared vault (1Password, Bitwarden) or your host's environment-variable manager — never in email or chat, where they sit in plaintext, searchable, forever. If a key has ever been pasted into a chat window (including an AI chat), rotate it now.
• Database and hosting. Invite your partner into your Supabase org and Vercel team from your own accounts. Don't hand over your personal login.
• Third-party accounts. Stripe, the email provider (Resend or similar), your domain registrar and DNS. Verify each was created under your email. If the AI platform created any of them on your behalf, find out now — not launch week.
• The ownership end-state. When the engagement ends, the repo, the deployment, the database, and the DNS must all live in accounts you control, and the contract must say the IP transfers to you. The test: could you revoke your partner's access in five minutes and still own a running product?

Phase 3: The Context the Code Doesn't Carry

This is the highest-value section of the checklist, because AI-generated code has a unique defect: it says what happens, but never what was supposed to happen. Your job in the handoff is to supply the intent layer the code never had.

• Write the intent gap. For each core flow, one or two sentences: what it's supposed to do, and where reality diverges. "Checkout should apply the discount code; right now it charges full price and shows the discount anyway" is worth more than any diagram.
• Mark what was prompted vs hand-edited. Hand-edited files are where you actually understood the code — and where a later AI regeneration may have silently overwritten your fixes. Both facts matter to the person inheriting it.
• Deliver the known-broken list. "Auth breaks on refresh." "Emails send twice." "The dashboard is fake data." This is the single most useful document you can hand over, and nobody competent will judge you for it — hiding it just means they find it mid-build, at your expense.
• Record a short Loom per core flow. Two to five minutes each, narrating what you intended while you click through — including where it breaks. Four honest videos beat forty pages of specification.
• Share the AI chat history. Your prompts explain decisions the code doesn't. Engineers recognize generated code within minutes anyway; hiding the origin only costs trust.
• Put 3+ real people through it before handoff. If only you have used the prototype, you don't know what's broken — you know what you've learned to avoid. Three outsiders will surface the failures your muscle memory routes around.

Phase 4: Scope and Priorities

The most expensive sentence in this entire process is "just make it production-ready." It sounds like a scope; it's actually a blank check. Production-ready for a demo to investors, for your first paying customer, and for 10,000 users are three different projects, and per Chrono Innovation's 2026 cost data, open-ended agency builds routinely run $30K–$100K+ — often for outcomes a tightly scoped hardening pass could have delivered.

The core distinction to make before any call: hardening what exists is a different job from building what doesn't. In Soatech's terms:

• Hardening: security, auth, tests, deployment for a prototype that basically works — a Production Lift, €3,500 fixed, one week.
• One new capability: a single production feature on the existing codebase — a Feature Sprint, €6,000 fixed, two weeks.
• A real V1: the prototype is a demo shell and the actual product still needs building — an MVP Sprint, €8,500–€22,000 fixed depending on flow count.

Your checklist:

• Split launch-blocking from post-launch. Two columns. Be brutal — most "must-haves" aren't.
• Classify every item as hardening or new build. Mixing them in one vague request is how budgets die.
• Fix your launch definition. First paying user? Investor demo? Public launch? Say which — it changes the quote.
• Not sure what's actually broken? Start with a Production Audit: €1,500 fixed, three days, a written severity-ranked diagnosis with no code changes — and the fee credits toward any build within 30 days.

Phase 5: Red Flags in Both Directions

What should worry you about a prospective partner:

• They won't quote a fixed price after seeing your code. (Refusing before reading it is prudence; refusing after is a process problem.)
• They insist on a full rebuild without having read the code. Sometimes a rebuild is the honest answer — but only after diagnosis, never as the default motion.
• They have no security review process for AI-generated code. Given the vulnerability rates above, that's disqualifying.
• They can't show verifiable shipped work. A live product you can click through — like Soatech's reference implementation wintura.ai — beats any portfolio slide.

The full evaluation framework is in How to Choose a Dev Agency.

What makes you a hard client to help:

• Access arrives in fragments over weeks. Every blocked day burns goodwill and calendar.
• You provide no context because "the code explains itself." It doesn't — see Phase 3.
• Scope moves weekly. Fixed price requires fixed scope; if you renegotiate mid-sprint, you've chosen hourly billing with extra steps.

The Handoff-Mistakes Table

Frequently Asked Questions

Should I clean up the code before handing it off?

No. Prompting the AI to "refactor and clean up" before handoff usually breaks working behavior and destroys the very context your partner needs. Hand it over as-is, with the Phase 3 context attached. Honest and messy beats polished and undocumented.

How do I share API keys with an agency safely?

Through a password-manager shared vault or your hosting platform's environment-variable manager — never email, never chat, never a Google Doc. Where possible, don't share the key at all: invite your partner into Stripe, Supabase, and Vercel with role-scoped access from your own accounts. Rotate every key when the engagement ends.

Will an agency insist on rebuilding my prototype from scratch?

Some will — it's the only motion they have. A credible partner reads the code first, then tells you which parts are salvageable and which aren't. Sometimes "rebuild" is the honest verdict; the red flag is hearing it before anyone has opened your repo. That's what a written diagnosis is for — evidence, not instinct.

What if my code is still locked inside the platform?

Check the export path first: Bolt and Lovable both support GitHub sync, and most tools offer some export route. If your prototype truly can't leave the platform, say so up front — extraction becomes step one, and it affects both scope and quote.

How long should handoff prep take?

Half a day to a full day for everything in this checklist: inventory, access setup, Looms, known-broken list, scope split. The prep costs nothing but time — the paid entry point, if you want a professional diagnosis first, is the €1,500 Production Audit.

---

Ready to hand off your AI prototype? Book a scoping call — your architect will review what you have and tell you whether it needs a hardening pass, a feature build, or a V1 sprint. Or start with the written verdict: a Production Audit is €1,500 fixed, three days, a severity-ranked written diagnosis — and the fee credits toward any build within 30 days.