Is your AI-built app production-ready? A 10-point checklist
If you built an app with Lovable, Bolt, or Replit — or paid someone who did — and you have a nagging feeling about it, that feeling is data. AI builders produce the visible layer brilliantly and the invisible layer inconsistently, and the gaps cluster in the same ten places every time.
Here is the checklist we run when a business brings us an AI-built app. Several checks you can do yourself in ten minutes, today, without reading code.
The ten checks
1. Log in as two different users, side by side
Open your app in two browsers as two different users (or two clients). Can either see anything of the other's — records, files, names in a dropdown? This is the big one: permissions must be enforced in the database (row-level security), not just hidden in the interface. Industry scans have found roughly one in ten vibe-coded apps exposing data this way, and it is trivially found by anyone who opens the browser's developer tools.
2. Copy a file link into an incognito window
Open a document in your app, copy its URL, paste it into a private window with no login. If the file loads, every "private" document in your app is public to anyone holding a link. Files must live in private storage behind expiring, signed links.
3. Try to break login
Request a password reset — does the email arrive, and does the link expire? Sign up with the same email in different capitalisation. Stay idle for a day — does the session ever expire? Auth demos well and leaks at the edges; the edges are where your customers live.
4. Find out where your secrets are
API keys for Stripe, OpenAI, or your database must live on the server, never in the browser. Quick self-test: view your page source and search for "key". A finding here means anyone can run up bills on your accounts. This is the most common gap that costs actual money fastest.
5. Ask: "if the database vanished tonight, what happens?"
If the answer isn't "we restore this morning's backup", you don't have an app, you have a liability with a UI. Automated daily backups, tested at least once, are non-negotiable the day real business data enters the system.
6. Follow one payment all the way through
If you take money: what happens when a card fails mid-subscription? When a webhook doesn't arrive? When a refund is issued — does the customer keep access? Checkout is the easy half; reconciliation is the half AI builders skip.
7. Do something wrong on purpose
Submit a form with garbage, upload a 200MB file, double-click every button. A production app rejects bad input politely. A demo throws a white screen — and tells an attacker what's underneath.
8. Check who would know if it broke
If the app went down at 2am Saturday, would you find out from monitoring or from an angry client on Monday? Production means error tracking and an uptime check, both of which cost nearly nothing.
9. Confirm you actually own it
Can you export the code to your own GitHub? Do you hold the credentials to the database, hosting, and domain — or does a freelancer? The moment to fix this is now, not during a dispute. (This applies double if you paid someone to build it.)
10. Name the regression loop
If your recent history is "fixed one thing, broke another, credits burning" — that is not you failing; that is the codebase exceeding what the AI can hold in its head. It's the clearest signal the project has changed phases and further prompting will cost more than engineering would.
8–10 passes: ship it — genuinely. 5–7: harden before real client data arrives; typically $4,000–$15,000 of focused work. Under 5, with client data or payments live: stop adding features and fix the floor first. The good news in every case: your frontend and data model are probably fine. The gaps concentrate in the invisible layer, which is the cheaper part to fix.
What to do with a bad score
Don't start over. The reflex is shame followed by "we should rebuild properly". Usually wrong. The app you have is a working spec of exactly what you want — something no document achieves. A competent team keeps the sound parts and rebuilds the invisible layer. Anyone who quotes a full rewrite before auditing what you have is quoting their preference, not your need. (More on that hand-off in AI builders vs hiring a developer.)
Get an audit, not a vibe. A structured audit against this checklist takes days and a low four-figure fixed fee — ours is credited against any fixing work, which keeps our incentives honest. What you should receive: a pass/fail on each point, what each failure means in plain business terms, and a fixed price to close the gaps. Costs for the fixing work itself are in our pricing breakdown, or the calculator has a "fix an AI-built app" mode.
Then set the maintenance answer. Whoever hardens it should also answer month four: who fixes it when an upstream API changes? A named owner or a small monthly arrangement. An app nobody owns fails this checklist again within a year.
Frequently asked questions
Is an app built with Lovable or Bolt safe to launch?
Sometimes — it depends on what the app holds. A tool with no logins and no sensitive data can ship as-is. Anything holding customer data, client documents, or payments needs the invisible layer verified first: server-enforced permissions, private file storage, backups, and payment reconciliation. AI builders generate the visible layer well and the invisible layer inconsistently.
What is the most common security gap in AI-built apps?
Missing or misconfigured row-level security: user A can query user B’s data because permissions were enforced in the interface rather than the database. Industry scans have found roughly one in ten vibe-coded apps exposing data this way. It is invisible in normal use and trivially found by anyone who opens the browser’s developer tools.
What does an audit of an AI-built app cost?
A structured audit against a production checklist typically costs a low four-figure fixed fee and takes a few days, with the fee usually credited against any fixing work. Hardening an app that passes most checks runs $4,000–$15,000; a genuine rebuild of the invisible layer can reach $25,000. Distrust anyone who quotes a rebuild before auditing.
Do I need to rebuild my AI-built app from scratch?
Usually not. The frontend and data model of AI-built apps are often perfectly sound and worth keeping; the gaps concentrate in auth, permissions, and infrastructure. Keep what works, rebuild the invisible layer, and treat your prototype as the spec it is.
Want the checklist run properly?
Fixed-fee audit, days not weeks, fee credited against any fixes. Worst case, you buy certainty that you're fine.
Book an audit call