How do you decide an AI-built app is ready for real users?
by•
I review a lot of apps that founders built with Lovable, Bolt or Cursor. They usually work well in a demo. The problems show up later, once real people sign up and pay.
The ones I see most often are a payment webhook that accepts any request, a database table anyone can read with the public key, and an AI route with no limit, where one script can run up the bill overnight.
What I have not figured out is how non-technical founders should handle this. Hiring someone to review every version is slow and expensive, and the AI tool will usually tell you everything is fine.
If you have shipped something built with AI, what was your check before launch? Did you have one at all, and what broke afterwards?
28 views
Replies
we keep a no list in the spec, like no user reads another users rows, and check the build against it
@leoheo That’s a smart way to frame it. Writing the “no” rules down before the build means the AI has something concrete to be held to, not just “make it secure”. How do you check the build against the list: by hand before each release, or with tests that try to break each rule? And what else is on it besides row access?
@smiteshrmore by hand for now lol. your second test user trick is going on it
To start it off, here is what I do today: before launch, I log in as a second test user and try to read the first user’s data, send a fake payment event to the webhook, and call the AI route in a loop to see if anything stops it. It takes about an hour, but most founders I talk to never do it. What would you add?