Setting up an engineering department is more than just writing code. You need architecture, a database, infrastructure, testing, design, deployment, and a plan to keep it all running as you grow. Most first-time founders dramatically underestimate this; they think “building” means opening a code editor and hacking until something works. That approach gets you a prototype (which are still important when you start!). It does not get you a company.
This chapter walks through the full lifecycle of building a software product, from initial spec to production deployment to ongoing infrastructure management. At each step, we'll show you what matters, what most people get wrong, and how Cofounder can handle the heavy lifting so you can focus on your product.

Before you write a single line of code, you need a plan: a clear, minimal specification of what your product does and who it's for.
The goal at this stage is to define your minimum viable product (MVP). This is the smallest version of your product that delivers real value to a real user. It is not a landing page. It is not a demo. It is a working piece of software that solves a specific problem well enough that someone would actually use it.
To define your MVP, answer three questions:
Be ruthlessly specific. “Helping people manage their finances” is not a problem statement. “Freelancers lose track of quarterly tax estimates because existing tools assume W-2 employment” is. The tighter your problem definition, the easier every subsequent decision becomes.
List every feature you think you need, then cut half of them. Seriously. If your MVP has more than three to five core features, it's too big. You're not building the final product; you're building the first thing real users will test.
Web, mobile, or desktop? For most startups, start with web. It's the fastest to build, the easiest to deploy, and the simplest to iterate on. You can always go native later once you've validated the product.
Once you have answers, write them down. This is your spec. It doesn't need to be formal — a one-page document or even a detailed bullet list works. What matters is that you've thought through the scope and committed to a boundary.
Use Plan Mode in Cofounder to come up with a product plan. The agent will help you think through your feature set, identify what's truly essential for your MVP, and produce a structured spec you can work from. This is especially useful if you're a non-technical founder who isn't sure what's feasible or how to scope things properly.
Cofounder currently supports web applications. If you're building mobile or desktop, you'll need to handle that outside of Cofounder for now, though web-first is almost always the right call for an early-stage startup anyway.
Your code needs a home. That home is aGit repository, hosted onGitHub.
If you're not familiar with Git, here's the short version: Git is a version control system that tracks every change you make to your code. GitHub is a platform that hosts your Git repositories in the cloud, lets multiple people collaborate on the same codebase, and provides tools for code review, issue tracking, and automation.
Why does this matter? Because without version control, you're one bad edit away from losing hours (or days) of work. With it, you can experiment freely, roll back mistakes, and work with teammates without stepping on each other's code.
Setting up a repository involves a few things:
A repository is the source of truth for your product.
Every meaningful change moves through a branch, a review, and a protected main branch before production sees it.
Protected branch. Only reviewed code lands here.
README, .gitignore, branch rules, and clear project structure.
A quick note on terminology you'll encounter throughout this chapter: abranchis a parallel copy of your code where you can make changes without affecting the main version. Think of it like a Google Doc suggestion — you're proposing changes that can be reviewed before they're accepted. Apull request(or PR) is how you propose merging a branch's changes into the main codebase. It's a formal “here's what I changed, please review it” request. These two concepts are fundamental to how modern software development works, and you'll see them referenced throughout this guide.
If you want to learn more about Git and GitHub fundamentals,GitHub's own Getting Started guideis excellent. But honestly, for most founders, you don't need to become a Git expert. You need a repo that's set up correctly, and then you need to write code.
Before you start coding, set up deployment. Yes, before. This is counterintuitive but important.
Here's why: if you wait until you've written a bunch of code to figure out deployment, you'll inevitably run into environment-specific bugs, configuration headaches, and “it works on my machine” problems. By setting up deployment first, every change you make is immediately visible in a real environment. This tightens your feedback loop dramatically.
We recommendVercelfor deployment. It's built for modern web frameworks (especially Next.js), handles scaling automatically, and has an excellent developer experience. Vercel is free to start with a generous hobby tier, and paid plans start around $20/month per team member when you need more.
You need three environments:
Deployment— traditionally, this is your local machine where you write and test code. In a traditional setup, this means installing Node.js, a code editor, and running your app locally with commands likenpm installandnpm run dev. This can be a pain to configure, and “it works on my machine” is one of the most common problems in software development.
With Cofounder, you can skip local development entirely — agents write code and deploy it to preview environments, so you review live URLs instead of running anything on your laptop. If you do want a local setup (and some founders prefer it for speed), Cofounder can help you configure that too.
Staging— a cloud environment that mirrors production. This is where you test changes before they go live. Staging should be connected to your main development branch.
Production— the live environment your users see. This should only receive code that has been tested in staging.
You should also set uppreview environments. Vercel does this natively — every time you push a new branch or open a pull request, Vercel creates a unique URL where you can see exactly what your changes look like. This is incredibly useful for reviewing features before merging them.
Preview environments become even more powerful when you're working with AI agents. In a traditional development workflow, you'd review code in a pull request, try to visualize the changes in your head, and maybe run the branch locally to actually see them. With preview environments, every PR an agent opens is immediately deployed to its own live URL. You can see exactly what the agent built, click through it, and decide whether to merge — all without pulling a single branch to your local machine.
This matters because agents work fast. A single agent can open multiple PRs in the time it takes you to review one. Preview environments let you keep up: you can review several changes in parallel, each in its own live environment, and merge the ones that look right. It turns code review from a bottleneck into a lightweight quality gate. Instead of being the person who writes every line, you become the person who steers — directing agents, reviewing their output, and shipping the good stuff. This is what agent-native development looks like, and preview environments are the infrastructure that makes it practical.
Code moves through gates before users see it.
code leaves a branch
temporary live build
human gate
safe prod mirror
release gate
real users
Your app will need API keys, database connection strings, auth secrets, and other sensitive configuration values. These shouldneverbe hardcoded in your codebase — not even in a private repo. If a secret ends up in a Git commit, it's in your history forever (or at least until you go through the painful process of rewriting history to remove it).
The right approach is to useenvironment variables. These are values stored outside your code that get injected into your app at runtime. Vercel has built-in support for environment variables, and you can set different values for each environment (development, staging, production). This means your staging app can talk to a staging database while your production app talks to the real one, all without changing a line of code.
A few rules of thumb for secrets management:
.envfiles.Add them to your.gitignoreimmediately.Cofounder includes built-in secrets management, secured via Vercel. You can store and manage your environment variables directly through Cofounder — it handles syncing secrets across environments and ensures they're never exposed in your codebase.
Cofounder sets up your Vercel deployment automatically, including staging and production environments. You'll go from zero to a fully deployed app pipeline without touching Vercel's dashboard.
Now it's time to actually write code. The first step is scaffolding — setting up the foundational structure of your application.
Any modern web app has two sides:
For your tech stack, we recommend:
This stack — Next.js + Supabase — is battle-tested, well-documented, and one of the fastest ways to go from zero to a working product. It's also what Cofounder is optimized for.
On cost: GitHub is free for private repositories. Supabase has a free tier that's more than enough for development and early users, with paid plans starting at $25/month when you need more storage or compute. Between Vercel and Supabase, you can realistically run a production app for under $50/month until you have meaningful traffic. Don't let infrastructure costs scare you — the expensive part of building a startup is your time, not your server bill.
A scaffold is the skeleton of the product, not just a folder tree.
components + forms
buttons, states, validation, loading UI
auth
who is this user?
database
what should persist?
storage
where do files live?
policies
what can they access?
route renders screen -> form calls action -> API validates -> database/storage changes -> UI refreshes state
Your backend is the foundation everything else sits on. Get it wrong and you'll be dealing with security vulnerabilities, data loss, and architectural rewrites down the line. Get it right and it quietly does its job while you focus on the product.
At minimum, your backend needs four things:
Authentication is how your app knows who a user is. It covers sign-up, login, password reset, session management, and (increasingly) social login via Google, GitHub, etc.
Do not build your own authentication system. This is one of those areas where rolling your own solution is almost always a mistake. Auth looks simple on the surface — it's just a login form, right? — but under the hood, there are dozens of security concerns: securely storing passwords, managing login sessions, preventing brute-force attacks, handling “forgot password” flows, and more. Getting any one of these wrong can expose your users' accounts. Use a proven solution.
Supabase Auth handles all of this out of the box. It supports email/password login, magic links (passwordless login via email), and social login with providers like Google, GitHub, and Apple. It also integrates with Supabase's database security so you can control what data each user is allowed to see — for example, ensuring users can only access their own records, not anyone else's.
You need somewhere to store your data. Supabase gives you a full database that can handle everything from simple user profiles to complex data with many relationships between different types of records. It's the same type of database (PostgreSQL) that powers some of the largest apps in the world, so it won't be something you outgrow.
Think carefully about your data structure early. What are the main things your app tracks? Users, orders, messages, projects? How do they connect to each other? For example, a user has many orders, and each order has many items. Getting this structure right early saves you from painful restructuring later.
That said, don't overthink it. Your data structure will evolve as your product evolves. Start with what you need for your MVP and iterate.
A note ondatabase migrations: when you need to change your database schema after you've already launched (adding a new column, renaming a field, changing a relationship), you can't just edit the schema like you would a document. You need to write a migration — a set of instructions that transforms the database from the old structure to the new one without losing existing data. Supabase has built-in migration support, and this is one area where being careful pays off. A botched migration on a production database with real user data is one of the worst situations you can be in as a founder.
Your API layer is how the pages your users see communicate with your server and database. When a user clicks “submit” on a form, or a page needs to load a list of items, those requests go through your API. In Next.js, you define these directly in your project — no separate server needed.
Your API handles things like: loading data for a page, saving form submissions, running business logic (“when a user does X, also do Y and Z”), and talking to third-party services like Stripe or Postmark.
Keep these routes clean and well-organized. Make sure they check that incoming data is valid before doing anything with it, and that they return helpful error messages when something goes wrong. These are the boring fundamentals that separate a production-quality app from a hackathon project.
Almost every real product needs to integrate with external services. Two are nearly universal:
Payments.If you're charging users, you need a payment processor. We recommendStripe. It handles credit card processing, subscriptions, invoicing, and tax compliance. Stripe's API is well-documented and battle-tested — it powers payments for companies from early-stage startups to Fortune 500s. Stripe charges 2.9% + 30¢ per transaction with no monthly fee, so you only pay when you make money.
Setting up Stripe involves creating an account, adding Stripe's code library to your app, building the checkout experience your users will see, and setting up webhooks. Webhooks are how Stripe tells your app about events — “this payment succeeded,” “this subscription was cancelled,” “this card was declined.” Your app needs to listen for these notifications and respond appropriately (e.g., granting access after a payment, or sending a follow-up email after a cancellation). This is one of those integrations that seems simple but has a lot of edge cases: failed payments, refunds, subscription upgrades, partial charges, and so on.
Transactional email.Your app will need to send emails — welcome emails, password resets, receipts, notifications. We recommendPostmarkfor this. Postmark is fast, reliable, and focused specifically on transactional email (as opposed to marketing email). It has excellent deliverability, which means your emails actually land in inboxes instead of spam folders. Postmark offers a free tier for development, with paid plans starting at $15/month for 10,000 emails.
Other integrations you might need depending on your product: file storage (Supabase includes this), analytics (covered in the Scale chapter), error monitoring, and various SaaS APIs specific to your domain.
Your app needs to react when outside services send updates.
checkout -> subscription -> invoice
Webhook confirms payment before the app grants access.
signup -> reset -> receipt
Transactional email should be triggered by product state.
validate request
write database
handle webhook
This is the one that trips up most first-time founders. You are responsible for making sure your app doesn't leak user data. This means:
This is not optional. A data breach can kill a startup — both legally and reputationally. Even if you're using Cofounder to help set things up, it's still on you as the founder to understand your security posture and ensure user data is protected.
Cofounder sets up backend best practices for you — Supabase Auth integration, database schema with row-level security, environment variable management, and secure API route patterns. It gives you a strong starting point, but it is not a substitute for understanding your own security posture. As a founder, you are ultimately responsible for the security of your users' data.
The frontend is where your product comes to life. It's what users interact with, and it's often the difference between a product people love and one they abandon after thirty seconds.
Frontend development in 2026 is primarily done inTypeScript(a typed superset of JavaScript) using component-based frameworks like React (which Next.js is built on). The good news: this is an area where AI agents excel. Translating designs and user flows into working UI code is one of the things agents do best.
That said, the agent is only as good as your direction. You need to deeply understand your UX and business logic:
Traditionally, building a frontend meant hiring a designer to create mockups in Figma, then handing those designs to a developer to implement. This was slow, expensive, and created constant back-and-forth between design and engineering.
In 2026, agents can design directly in code. Instead of creating a static mockup and then translating it, you describe what you want and the agent builds a working version immediately. You can see it, click through it, and iterate on it in real time. This collapses the design-to-code pipeline into a single step.
This doesn't mean design thinking is irrelevant. You still need to understand your user flows, information hierarchy, and interaction patterns. But the artifact you produce is working code, not a Figma file. And because iteration is nearly instant, you can try ten variations in the time it used to take to get feedback on one mockup.
Once you have this clarity, building the frontend is largely execution. You're translating your flows and product thinking into components, pages, and interactions.
Use the app like a customer, then fix the parts that feel off.
test the app
click through the real flow
find odd parts
confusing copy, dead ends, awkward states
fix and repeat
ship the smallest useful improvement
Keep cycling until the product flow feels obvious to someone using it for the first time.
Cofounder enables you to make instant edits to your app by commenting to the agent. See something that looks off? Describe what you want changed, and Cofounder updates the code. This turns frontend iteration from a slow dev cycle into a real-time conversation.
Cofounder's code generation engine can build entire pages and components from descriptions, wireframes, or reference screenshots. You describe what you want, and it writes the TypeScript, handles the styling, and connects it to your backend.
You've got a working app in staging. It's time to go live.
Deployment is the process of taking your tested code and making it available to real users. If you set up Vercel earlier (which you should have), this process is straightforward:
Quickly test in preview environments.Before anything gets merged to staging, review it in its preview environment. Click through the changes, test the flows, make sure it looks and works the way you expect.
Test thoroughly in staging.Once branches are merged, test the integrated result in staging. Use your app like a real user would. Try to break it. Click things you're not supposed to click. Enter data you're not supposed to enter. Find the bugs now, not after launch.
Merge to main.Once you're confident staging is solid, merge your code to the main branch. This should go through a pull request with a code review (even if you're reviewing your own code).
Deploy.Vercel automatically deploys your main branch to production. If you've set things up correctly, this is a one-click operation.
Verify in production.After deployment, check that everything works in the live environment. Sometimes things that work in staging break in production due to environment differences (different API keys, different database, different domain configuration).
A note on backend deployment: Vercel handles your frontend and API routes natively. For anything that needs to run in the background or run longer than a standard API request — things like sending a batch of emails, processing a file upload, running an AI pipeline, or handling a webhook that kicks off a chain of operations — you'll wantVercel Workflows.
Vercel Workflows lets you run background processes alongside your app. Here's the problem it solves: a normal API request needs to respond in a few seconds, but some operations take much longer — sending 1,000 emails, processing a large file, or running a multi-step AI pipeline. Workflows lets you kick off these long-running tasks, and it handles the hard parts automatically: if a step fails, it retries it; if the process is interrupted, it picks up where it left off; and you get a dashboard showing exactly what ran and when. Unlike older approaches that required setting up separate infrastructure, Workflows lives inside your existing Vercel project — no extra services to manage.
Cofounder can handle your deployment workflow — testing in staging, creating pull requests, merging, and promoting to production. It manages the full CI/CD pipeline so you can focus on what to build, not how to ship it.
Here's an uncomfortable truth: AI-generated code can be mediocre. It works, technically, but it's often verbose, poorly structured, and riddled with subtle issues that only surface under real-world conditions. The industry has a term for this:AI slop.
Avoiding slop requires discipline. Here's how:
Generated code needs to pass three checks before it ships.
does the core flow work?
is it consistent and low-risk?
does it feel right in the app?
Bad tests are another form of slop. They must prove user outcomes, not merely confirm implementation details.
Automated tests verify that your code works as expected. There are several types:
You don't need 100% test coverage on day one. Start with tests for your core flows — the critical paths that, if broken, would make your app unusable. Then expand coverage over time.
A crucial warning:when using agents to write tests, verify that the tests actually test something meaningful.A common failure mode is agents writing tests that are circular — they essentially check “does this code do what this code does?” instead of “does this code do what the user needs it to do?” Even worse, agents sometimes write tests that are rigged to pass no matter what, or that skip testing the actual important part. Always review test logic manually. If a test looks too simple or too clean, it probably isn't testing anything useful.
Linters are tools that automatically scan your code for common mistakes and style inconsistencies — think of them like spell-check and grammar-check for code. The standard tools for JavaScript/TypeScript projects are ESLint (catches potential bugs) and Prettier (keeps formatting consistent). Set them up to run automatically every time code is saved or committed. This is especially important when AI agents are writing code, because different agents (or the same agent on different days) might use slightly different styles. Linters keep everything consistent.
If you're using AI agents to write code (and you should be), set up rules files that guide their behavior. These are typicallyagents.mdor.cursorrulesfiles in your repo root that tell the agent about your codebase conventions, tech stack, and patterns.
Good rules files include:
The better your rules file, the better your agent output. Think of it as onboarding documentation for an AI team member.
Cofounder uses browser agents to test your app autonomously. These agents navigate your app like a real user, clicking through flows, testing edge cases, and verifying that things work as expected. When they're done, they generate a video of the changes so you can see exactly what was tested and how the app behaved — without having to click through everything yourself.
Finally, use your own product. Constantly. Every feature you build, use it the way a real user would. Click through the flows. Try edge cases. Use it on your phone. Use it on slow internet. This kind of hands-on testing catches things that automated tests miss — awkward flows, confusing copy, interactions that technically work but feel wrong.
Cofounder sets up agent rules, linting, and verification loops. These rules are also self-improving, with Cofounder adding new rules as you develop.
Your app will break. Not if — when. A database query will time out. An API integration will return unexpected data. A user will find a flow you never tested. This is normal, and how quickly you can diagnose and fix issues is one of the most important skills you'll develop as a founder.
The first question when something breaks is:where do you look?
Vercel logsshow you what's happening in your API routes and serverless functions. If a page isn't loading or an API call is failing, start here. Vercel's dashboard shows real-time logs, error rates, and response times.
Supabase logsshow you what's happening in your database. If data isn't saving correctly, queries are slow, or authentication is failing, check Supabase's dashboard. It shows query performance, auth events, and database errors.
Browser developer toolsare your frontend debugging toolkit. Every browser has built-in tools (usually opened with F12) that let you inspect network requests, see JavaScript errors, and examine the page structure. For a non-technical founder, the “Console” tab (which shows errors) and the “Network” tab (which shows what requests your app is making) are the most useful.
For more serious monitoring, consider addingerror trackingwith a service likeSentry. It automatically captures errors in your app, shows you exactly where they happened, and groups similar errors together so you can prioritize fixes.
The key insight about debugging: most bugs aren't mysterious. They're usually one of a few things — a typo, a missing environment variable, an API that changed its response format, or a database query that doesn't account for a new edge case. The hard part isn't fixing the bug; it's finding it.
Cofounder includes browser agents that can assist in debugging. These agents can navigate your app, identify visual issues and errors, and help trace problems from the UI back to the code. When something breaks, you can describe the problem and Cofounder will help you locate and fix it.
Congratulations, your app is live. Now you have to keep it running.
Post-deployment, infrastructure management is primarily about two things:reliabilityandcost.
As your user base grows, your database needs to handle more data and more people using it at the same time. Supabase manages most of this for you — it can automatically scale its resources up and down based on demand.
What you need to watch for:
Vercel handles frontend and API scaling automatically — it spins up more resources as traffic increases and scales them back down when it drops. This is great for handling traffic spikes without manual intervention.
The catch: this can get expensive quickly at scale. Vercel charges based on usage, and if you're not careful, a traffic spike (or a bot repeatedly hitting your app) can run up a significant bill.
Strategies for managing compute costs:
There's a classic founder dilemma here: do you throw money at infrastructure to move fast, or do you optimize ruthlessly for efficiency? The answer depends on your stage. Early on, optimize for speed — your time is more valuable than your server bill. As you scale, efficiency becomes critical because infrastructure costs can eat into your margins.
Cofounder monitors your infrastructure and can flag performance issues, make PRs to fix issues, and help you manage scaling decisions as your product grows.
Building is not a one-time event. It's a continuous cycle of shipping, learning, and iterating. Once your MVP is live, the real work begins — watching how users interact with your product, identifying what's broken or confusing, and improving relentlessly.
In the next chapter,How to Sell, we'll cover how to take what you've built and get it in front of users — from building a brand to running your first sales campaigns to setting up marketing that actually works.
But first: ship something. The best product plan in the world is worthless if it stays in a document. Get your code into production, get it in front of real people, and start learning. Everything else follows from there.