I write here about the same problem I get paid to solve: AI-built apps that work in a demo and might not be safe with real users, real payments, or real data. No thought-leadership padding — each piece starts from a question a founder actually has and ends with a decision they can make.
I explain the technical parts when they affect a decision. The questions are usually simple: can this lose customer data, take the wrong payment, lock someone out, or fail without a way back?
Topics include vendor risk, incident postmortems, and what a real launch-ready checklist covers — not vague AI hype, just problems founders will actually run into.
Your AI agent says the build passed. That tells you the build's configured checks passed — not necessarily that sign-in works, a payment is recorded correctly, or one customer's data stays private.
Your AI-built app runs on code you never chose — most of it code you'll never even see named. Here's what that means, the AI-specific risk worth knowing about, and a safe prompt to check yours.
Your AI agent picked which outside services your app depends on — payments, email, auth, AI. Here's what to check about how those failures show up, and a safe way to verify anything alerts you.
Git keeps a history of the versions of your app that are committed. GitHub stores and shares that history online. Neither requires a command line — here's what to check, and what to ask your AI agent.
A one-question self-diagnostic for AI-built apps: could a new developer pick up your project from the docs alone, or does every quote start with a week of reverse-engineering?
An API key is a password for machines. One easy mistake is bundling a secret straight into the JavaScript your users' browsers download. Here's the F12 check, and what to ask your agent.
CI isn't a second opinion on your agent's work — the same agent may have written the tests and the CI config too. What it gives you is something narrower and just as important: the same checks, rerun the same way, every single time.
A competent AI-built product can still feel like nobody wanted it. A comparison from my own work — one project that drifted, one that converged — shows what was actually missing.