Merged · vibe-coded to production
VoyRally: a traveller's vibe-coded trip planner, taken to production
A traveller from the UK vibe-coded a group trip planner with AI tools: shared itineraries, maps, budgets, and checklists. It worked on a laptop but wasn't ready for real users. We fixed what broke, closed the security gaps, and launched it on its own production infrastructure.
Visit voyrally.cosmerg.com- Client
- Independent traveller, UK
- Duration
- 1 week to production
- Year
- 2026
- Stack
Results
Before and after.
Invite takeover risk
OpenClosedDeploys
ManualAutomaticItinerary times across time zones
ShiftedCorrect
The nebula
Where it started.
- Trip invites could be claimed by anyone who signed up with the invited email address, without verifying it.
- Times shifted depending on the server's and each traveller's time zone, so itineraries showed the wrong hours.
- Live updates between travellers worked locally but stalled behind a real web server.
- No Docker, no CI, no health check, and no way to deploy safely.
What we did
Into orbit, step by step.
Scan
Reviewed the code, authentication, and data model, and tested the app the way a group of travellers would use it.
Merge
Required verified emails before invites attach to an account, stored one-time tokens as hashes, fixed time zones by storing times consistently, and fixed rendering and layout bugs.
Launch
Containerised the app, added CI that builds every change, and deployed automatically to a hardened server behind Cloudflare with a health check and one-step rollback.
Orbit
Live at voyrally.cosmerg.com, with its own email for verification and invites, and database migrations applied safely on every release.
Got a vibe-coded app like this?
Tell us where you are. We'll reply within one business day with the smallest useful first step.