Built Your App With AI? Check This First

Fast prototypes are a good thing

Tools like Cursor, Lovable, Bolt and Replit let founders describe an app and watch it appear. 'Vibe coding' is a fine way to test an idea, show investors something real and get early feedback in days instead of months.

The trouble starts when the prototype quietly becomes the product: real customers sign up, real payments go through, and nobody has checked what the code does when things go wrong.

Why prototypes break in production

AI tools write for the happy path. The common gaps are predictable:

• Security is left at the defaults, or only enforced in the browser where anyone can bypass it.
• Errors are swallowed, so failures go unnoticed until a customer complains.
• Nobody on the team fully understands the code, so every fix is a guess.
• The app works for ten users and slows down, or gets expensive, at a thousand.

The eight checks before launch

Work through these before you invite real users or store real data:

• Access on the server: every request checks who the user is and what they may see. Hiding a button is not security.
• Database rules: if you use Supabase or Firebase, turn on row-level security for every table, then log in as a second user and try to read the first user's data.
• Secrets out of the code: API keys never belong in front-end code or the repository. Rotate any key that was ever exposed.
• Input checks: validate everything that comes from forms and URLs on the server, and use parameterized database queries.
• Errors and logs: failures show the user a helpful message and are recorded where your team will see them.
• Dependencies: confirm every package is real, maintained and up to date. AI tools sometimes suggest packages that don't exist or are years old.
• Backups: automatic backups, and one restore you have actually tested.
• Load and cost limits: try realistic traffic, and cap paid APIs so a bug can't run up a bill overnight.

Make the code something you can own

Code you can't explain is code you can't fix. Add automated tests for the flows that make money, such as sign-up, checkout and the core feature. Write a short readme on how to run and deploy the app. From now on, have a person review every change before it goes live, whether a developer or an AI tool wrote it.

Harden it or rebuild it?

Most prototypes don't need a full rewrite. If the data model is sound, fixing security, adding tests and cleaning up the riskiest parts is usually enough. If the data model is wrong, every new feature will fight it, and rebuilding that core early is cheaper than patching it forever.

A short code audit tells you which case you are in, before your users find out for you.