Built with an AI tool? We take it from there.
Every builder gets you to a working demo. None of them get you to a service that survives real users, real money and real attackers. Here is what breaks in each one, what it costs when it does, and how we close it.
Six platforms, one standard
Whatever built it, the Production Check asks the same questions:
- Access rules tested against real roles, not read for plausibility
- Secrets traced from source, git history and the shipped bundle
- Query plans and indexes on the paths that get slow first
- Backups actually restored, with the recovery time written down
- Infrastructure cost modelled at ten and a hundred times today
The 10 we see most
Each page is written from the findings we file against that platform, not from its marketing site.
- Lovable
React and Supabase generated from a chat. The front end is usually fine; the access rules underneath it are where the risk sits.
Most common critical findingRead the Lovable playbookRow-level security that reads correctly as the logged-in user and also returns everyone else's rows.
- Replit
Agent-built code running in a repl. Fast to a working demo, but the runtime, the disk and the secrets all have to change before real traffic.
Most common critical findingRead the Replit playbookThe framework's development server still serving production, single-worker and unhardened.
- Base44
Full-stack internal tools and SaaS built inside the platform. The open questions are record-level access, observability and ownership.
Most common critical findingRead the Base44 playbookAuthorization enforced in the UI but not at the data layer, so the API returns other tenants' records.
- Claude Code
Real code in your own repository, written quickly and in volume. The gaps are operational rather than syntactic.
Most common critical findingRead the Claude Code playbookNo deployment pipeline at all - production is whatever was last copied up by hand.
- Cursor
Code you own, written fast in your own editor, by an agent that holds whatever credentials you do. The gaps are where it runs and what it can reach.
Most common critical findingRead the Cursor playbookOne connection string shared by the editor and the running app, so a development session can write to the customer database.
- Bolt.new
A full-stack app generated in an afternoon, and genuinely good for the first eighty per cent. The last twenty is auth, data rules and the deploy story.
Most common critical findingRead the Bolt.new playbookAuthorization implemented as a client-side route guard, so the API answers anyone who skips the interface.
- v0
The best-looking React in the category - and, in most projects that reach us, a finished interface wired to mock data with no backend behind it.
Most common critical findingRead the v0 playbookExported server actions callable by anyone, reading the session but never checking it against the record being modified.
- Bubble
Visual apps that reach real revenue and then hit a wall of workload units, slow list pages and privacy rules added late.
Most common critical findingRead the Bubble playbookPrivacy rules the interface respects and the Data API does not, exposing fields no screen ever showed.
- Supabase
An excellent production database, when it is configured like one. Most AI-generated projects have never been configured at all.
Most common critical findingRead the Supabase playbookTables with row-level security switched off, or a policy of using (true), reachable with the public anon key.
- Firebase
Auth, storage and a database working in an afternoon. The rules that decide who reads what, and the bill that grows with reads, both arrive later.
Most common critical findingRead the Firebase playbookSecurity rules still in test mode, leaving every document in the project readable by any visitor.
Different tools, the same six holes
The builders differ in language, hosting and pricing model. The distance between what they generate and what production needs is almost identical - and cost is the seventh hole, because per-seat, per-request and per-workload-unit pricing scales against you exactly when traffic starts to matter.
Authentication works. Authorization does not.
Sign-up, login and password reset are generated correctly almost every time.
There is only one environment
Development, staging and production are the same project pointing at the same database.
Secrets are in the wrong places
API keys in the client bundle, service credentials in committed .env files, tokens pasted into source during a session.
Nothing is watching
No error tracking, no uptime check, no structured logs. You learn about outages from a user email, and by then there is no trace left to reconstruct what happened or how many people it hit.
Backups have never been restored
Snapshots may well exist. Nobody has run a restore, timed it, or checked the dump is complete.
Deploys happen by hand
No pipeline, no checks on merge, no rollback, and often one person who knows the steps.
Four steps, and you can stop after any of them
Nothing here is a bundle. The audit stands alone, the fixes stand alone, and you own the result at every stage.
We work on the tool you used, whatever it was
Windsurf, Softr, Glide, Retool, FlutterFlow, or plain Next.js you wrote yourself - the failure modes are the same ones on this page. Permissive access rules, one environment, secrets in the wrong place, and no plan for the day something breaks. Send us a repo link or a screen recording and we will tell you which of them apply to you.
Read-only access is enough to start
A repository invite and a short description of who uses the app.
Findings ranked by severity
With reproduction steps, so your own developer could fix them instead.
No obligation after the report
Most people continue. Nothing about the deliverable depends on it.
Tell us what you built
A repo link and a paragraph is enough. The Production Check is free and the report is yours.