You built an app with AI. Here's what to fix before you rely on it.

Tools like Claude Code, Lovable and Replit have changed who can create software. A founder, an operations lead or a marketer can now describe an idea and get a working app in an afternoon. That is genuinely powerful — and it is where the easy part ends.

Getting from zero to a working prototype is a very different problem from getting a system a business can rely on day after day, with real data and real users. Below is the checklist we run before any AI-built app is trusted with anything that matters.

1. The data model

AI generators optimise for "make it work on screen", not for a data model that survives growth. Before you rely on the app, check that entities and relationships are modelled deliberately, that IDs and constraints exist, and that you can export your data at any time. A weak schema is the most expensive thing to fix later.

2. Authentication and permissions

Who can see and change what? Prototypes routinely ship with a single shared login, no roles, and secrets embedded in the frontend. That is fine for a demo and dangerous with customers' data. Proper auth, roles and a permissions model are non-negotiable before go-live.

3. Security and secrets

API keys in client code, no input validation, no rate limiting — these are common in generated apps and are exactly what gets exploited. A short security review usually finds several issues that are cheap to fix now and painful to fix after an incident.

4. Backups and recovery

If the database were lost tomorrow, what happens? Many AI-built apps have no backups and no tested way to restore. This is the single question that most often turns a "nice app" into a business risk.

5. Ownership and handover

Can someone other than the original author understand, run and change the app? If the knowledge lives only in a chat history, you have a continuity problem. Documentation, a clean repository and a reproducible deployment matter more than another feature.

Where this leaves you

None of this means AI-built software is a bad idea — it is a great starting point. It means the prototype and the production system are two different deliverables. The good news: hardening an app you already have is usually faster and cheaper than a rebuild, because the hard product decisions are already made.