Insights · 6 min read
Built your app with AI tools? Check these before real customers use it
By Austin Hunter ·
AI coding tools are genuinely good at getting from an idea to something that works on your screen. We use them every day, under developer review. The gap is usually not the features. It's the parts nobody sees in a demo: who can read whose data, what happens when a payment fails, and what happens at 2 a.m. when something breaks. Here's the list we'd go through before real customers depend on it.
Who can see whose data
This is the most common serious problem. Apps built quickly often check permissions only in the screens, not on the server or in the database rules, so a curious user can read or change other people's records. Test it directly: sign in as one user and try to load another user's data. If your app uses Firebase or Supabase, read the security rules line by line.
Secrets in the wrong place
API keys for paid services (AI models, email, maps, payments) must live on the server, not in the app or the website's code, where anyone can copy them. A leaked key for a paid API can turn into a large bill within hours. Set spending limits and budget alerts on every paid service while you're at it.
Payments that hold up
- Upgrades, cancellations and refunds are driven by the payment provider's webhooks, not by what the app says happened.
- Failed renewals and expired cards are handled, not just the happy path.
- There's one source of truth for who has paid, and support can look it up.
Backups you've actually restored
Turn on automatic backups for the database and file storage, then restore one into a test copy. A backup nobody has restored is a hope, not a plan.
Knowing when it breaks
Add crash reporting and uptime alerts that reach a person, plus basic logs you can search. Without them, your customers become your monitoring, and they usually just leave.
Store and platform rules
Apps in the App Store and Google Play have to keep up with yearly SDK and target-API requirements, privacy forms and review guidelines. Web apps need dependency and security updates. None of this is hard, but it never stops, so it needs an owner.
Getting a second pair of eyes
If you built the app yourself, or with a developer who has moved on, a short review is usually enough to find the issues above and size the fixes. We do that review, fix what matters at a fixed price, and can keep the app running afterwards on a monthly plan.