Before you put an AI-built app in front of customers

AI coding tools have made it possible to produce a working prototype very quickly, and for many internal tools that is exactly what is needed. The risk begins when the prototype quietly becomes the real thing: customers sign in, money moves or personal data is stored.

What a demo does not show

• Who can see whose data, and whether that is enforced on the server rather than only hidden on the screen.
• Where passwords, keys and tokens are kept, and whether any of them sit in the code.
• What happens when a payment, a message or an import fails half way.
• Whether there is a backup, and whether anyone has ever restored from it.
• Who is responsible when a library has a known weakness or a rule changes.

A short pre-launch check

• Try to read another user's record by changing an identifier in the address.
• Search the code and its history for keys and passwords.
• Confirm that the database is backed up and that a restore has been tried.
• Confirm that errors are logged somewhere a person will actually look.
• Write down who owns the app after launch.

Keep, fix or buy

After a review there are three honest outcomes. Keep it, because the risk is low. Fix it, because the structure is sound and the weak parts are few. Or buy a ready-made product, because the problem is common and someone already maintains the answer. The cheapest answer is often the third, and a reviewer who only sells building will not tell you so.

Where we come in

Our review is fixed in scope and price, ends with a written report, and tells you which of the three outcomes we recommend.