Practical writing on shipping AI-built apps to production: security audits, hardening, and the backend infrastructure that makes a prototype fit for real users and real data.
When an AI-built app for a client gets compromised, the liability lands on the builder, not the AI tool vendor. What contracts say, why the 'built to spec' defense fails in regulated industries, and what agencies should change before delivery — not after an incident.
The full 47-point production readiness checklist we use when auditing AI-built applications, covering authentication, authorization, input validation, data exposure, infrastructure, error handling, API security, and deployment health. A practical pre-launch gate, not a theoretical framework.
Lovable produces polished frontends with clean React and TypeScript. The security work concentrates behind the interface: Supabase policy enforcement, client bundle exposure, upload controls, and server-side operations. Here's the hardening profile we see in Lovable projects.
Authentication is the single highest-leverage security area for AI-built apps. Tokens that never expire, localStorage session storage, no rate limiting, predictable reset tokens, and client-side auth checks — why these failures recur and how to fix each one.
An anonymized audit report for a Bolt-built SaaS product with active users. 15 findings across four severity levels, what was specific to the Bolt build, and what happened after the builder received the report.
We load-tested a Cursor-built project management app with 200 active users. At 200 concurrent connections, average response times went from 180ms to 14 seconds. The fixes took four days and cost nothing in infrastructure. Here's what we found and what we changed.
Claude generates clean application code, but security gaps appear around the assumptions never made explicit in the prompt: hardcoded API keys, client-side authentication, missing rate limiting, permissive CORS, and no audit logging. Here's what to check before shipping.
A practical walkthrough of what a ProductionReady.co vibe code audit actually involves: automated analysis, expert review, a written findings report by severity, and a prioritized remediation roadmap. No second development project required — just the codebase and context.
A Unit 42 investigation documented an AI-assisted attack that compressed two weeks of intrusion tradecraft into under 10 hours. The attacker used no zero-day. Every stage exploited a routine gap that production hardening closes — and the same gaps show up in the AI-built apps we audit every week. Here is each stage, how common the exposure is, and the straightforward fix.
Cursor produces the strongest AI-generated code we review, but Cursor-built apps still share a recognizable security profile. Seven production issues recur across every Cursor project we audit — from cosmetic authentication to missing rate limiting — regardless of builder experience.
AI-built apps look finished long before they're production-ready. The gap between a working demo and a system real users can depend on is almost never the features — it's authentication, secrets, input validation, and the production controls AI tools don't generate on their own.
