From AI-built prototype to production: a practical checklist

Short answer: before real users and real money touch an AI-built app, lock down secrets and database access, move authorisation and payments to the server, add tests for the critical journeys, and deploy with separate environments, backups and monitoring.

AI tools are great at the first 70%

Tools such as Lovable, Bolt, v0 and Cursor can produce a convincing app in days. What they rarely produce is the last 30% that keeps an app safe and stable: security boundaries, error handling, tests and operations. That gap is invisible in a demo and very visible in production.

1. Secrets and configuration

• No API keys or service-role keys in front-end code or the repository
• Secrets stored in environment configuration, rotated if they were ever exposed
• Separate keys for development, staging and production

2. Database access rules

• Row-level security or equivalent rules enabled on every table
• Users can read and write only their own or their organisation's data
• Admin operations performed only through server-side code

3. Authentication and authorisation

• Every API route checks who the user is and what they may do
• Roles enforced on the server, not just hidden in the UI
• Session expiry, logout and password reset tested

4. Payments

• Prices calculated on the server
• Payment status confirmed by signed webhooks — see webhook-verified payments
• Refunds and failed payments handled explicitly

5. Tests

• A smoke test for sign-up, the core journey and checkout
• API tests for permission boundaries
• Tests run automatically before every deployment

6. Deployment and operations

• Separate staging and production environments
• Automated database backups with a tested restore
• Error tracking and uptime alerts going to a real person

Harden, refactor or rebuild?

Decide module by module. Interfaces and data models often survive; tangled business logic and insecure data access usually need refactoring; a full rebuild is the exception. Our AI-built app rescue service starts with exactly this review.