Production notes for
apps that were built fast
Long-form, specific writing about what actually breaks when an AI-built MVP meets real users - and the exact changes that fix it. Written by the engineers who do the work.
Security
Access control, secrets, and the failures that leak data.
Infrastructure
Servers, storage, and what breaks under real traffic.
Product
The gap between a working prototype and something people pay for.
Playbooks
Checklists and procedures you can run yourself.
Migration
Moving off builder hosting onto infrastructure you own.
Mobile
App stores, review guidelines, and native rebuilds.
Engagements
How we scope, price, and run the work.
All posts
Six deep dives, each one written from findings we file repeatedly in real audits.
- Security
Three days from launch to 4.75 million exposed records
Moltbook exposed 4.75 million records days after launch: one Supabase key in the bundle, no row-level security behind it. The check takes ten minutes.
7 min read - Security
A cloned repository can run commands in your editor
Two patched Claude Code CVEs let a cloned repo run shell commands and redirect an API key. The bug is fixed; what it exposed about agent config is not.
8 min read - Playbooks
The write failed and your user saw a success message
The most expensive AI-generated bug does not crash. It catches the error, returns a default, and reports success. Two greps find them in your repository.
7 min read - Infrastructure
Your Firestore bill is reads, not users
Firestore charges per document returned, so one unbounded list view can cost thousands of reads a visit. How to find yours, and the one-line count fix.
7 min read - Product
Millions of apps get built. Why so few become products.
Millions of AI-built apps, very few products. The gap is not code quality. It is four things between prototype and product that never show on screen.
13 min read - Security
Eleven all-caps warnings did not stop it: what agent access to production should look like
A coding agent wiped a production database during a code freeze. The real lesson is about credentials, and it holds whether or not an agent is involved.
12 min read - Infrastructure
What ten thousand users actually breaks, in the order it breaks
Ten thousand users is small for a database and large for an app nobody measured. The four bottlenecks in the order they arrive, and what each costs.
13 min read - Engagements
What a $2,000 production hardening project actually buys you
What a $2,000 production hardening project buys: where the hours go, what is in scope at that price, and when $2,000 is the wrong number to be paying.
10 min read - Migration
What moving off Replit actually costs, in money and in weeks
Moving off Replit costs real money and real weeks. Where the hosting crossover sits, what a migration runs, and the three cases for staying put.
11 min read - Mobile
Rejected under guideline 4.2: what Apple means by “more than a repackaged website”
App Store guideline 4.2 rejection, explained by what the reviewer actually opens. The six additions that clear it, and the ones that reliably do not.
12 min read - Security
The four holes we find in almost every Bolt.new app
Almost every Bolt.new app has the same four holes: a service key in the bundle, row-level security off, unescaped output, an unprotected login route.
13 min read - Mobile
React Native or Flutter: two questions that settle it
React Native or Flutter turns on two questions: what your front end is written in, and who maintains the app in two years. The rest is a tie-break.
11 min read - Migration
From builder hosting to your own cloud without downtime
Zero-downtime migration from builder hosting to your own cloud: inventory, parallel build, three shapes of data move, and a cutover you rehearse first.
12 min read - Playbooks
v0 gives you a finished frontend. The backend is the actual project.
v0 gives you production React and no backend at all. How to derive a schema from the components you have, plus two server action security mistakes.
11 min read - Product
The day your internal tool became load-bearing, and nobody noticed
Internal tools built with AI go load-bearing quietly. The four things that change once somebody's job depends on it, and the audit trail to add now.
11 min read - Playbooks
Your AI-built app just got its first enterprise security questionnaire
Your first enterprise security questionnaire, decoded: what procurement is really asking, and the six controls that unblock most of a 180-row sheet.
12 min read - Playbooks
A production readiness checklist for AI-built apps
The production readiness checklist we run before an AI-built app takes real users: secrets, authorization, data, backups, runtime, delivery and cost.
13 min read - Infrastructure
AWS or DigitalOcean for your first real deployment
AWS or DigitalOcean for a first real deployment: the question is who operates it on a Tuesday. A framework, six services, and when it is neither.
12 min read - Infrastructure
Why your Replit app falls over at 100 users
Development servers, ephemeral disks, sleeping instances and connection math. The four bottlenecks that show up together, in the order you should fix them.
12 min read - Security
Your service-role key is in your JavaScript bundle
A Supabase service-role key in your JavaScript bundle is a database superuser in public. Find it in ninety seconds, then rotate in the right order.
10 min read - Security
The Supabase row-level security mistakes in almost every AI-generated app
Supabase row-level security is the top critical finding in our audits. The five policy patterns that keep showing up, and the SQL that closes each one.
11 min read
Six ways in
Pick the track that matches where your app is right now.
Start here if you have not launched
The two failures that turn a launch into an incident, plus the checklist we run before we let an app take real users.
Start here if it is already falling over
Development servers, ephemeral disks, cold starts and connection limits - what to measure and what to fix in which order.
Start here if you are leaving the builder
The migration playbook, and an honest look at what a fixed-scope hardening project costs and delivers.
Start here if you are wondering why it stalled
Why so few AI-built apps become products, what ten thousand users actually breaks, and the internal tool nobody realised had become load-bearing.
Start here if you need to be in the app stores
The guideline that rejects most wrapped web apps, and the two questions that settle React Native versus Flutter.
Start here if you are selling to a bigger customer
What procurement asks, what a v0 or Bolt prototype cannot answer yet, and the order to close the gaps in.
Want this checked against your own app?
The Production Check is free, and the written report is yours either way.