A working demo and a production-ready product look identical in a screen recording. They are not the same thing. AI coding tools — Cursor, Lovable, Bolt, v0, Claude — are astonishingly good at getting you to “it works on my screen.” They are much less good at the boring, invisible parts that decide whether your app survives its first real users, its first security review, or its first month at scale.
I led an 80-person engineering firm’s move to AI-native delivery and built a multi-agent system to govern the quality of AI-written code across every project. So I don’t say this to scare you off AI — I build with it every day. I say it because I know exactly where AI-generated code quietly breaks. Here are the seven checks I run first.
1. Are there tests — and do they actually test anything?
AI loves to generate tests that assert true === true. Open the test folder. If it’s empty, that’s a red flag. If it’s full but every test is trivial or mocks away the thing being tested, that’s worse — it’s false confidence. Real question: if someone changed the pricing logic, would a test fail? If nobody knows, you have no safety net.
2. Is there any authentication and authorization logic you can trust?
The single most common serious flaw in AI-built apps is broken access control — a user can see or change data that isn’t theirs by tweaking an ID in the URL. AI generates auth that looks right and often isn’t enforced on the server. Check that every sensitive action verifies who is asking on the backend, not just in the UI.
3. Where do the secrets live?
Search the codebase for API keys, database URLs, and tokens. If they’re hardcoded, committed to the repo, or shipped to the browser, you have a leak waiting to happen. This is a five-minute check that prevents a very bad day.
4. Does the architecture have a ceiling you’ll hit soon?
AI optimizes for “make this feature work now,” not “make this scale to 10,000 users.” Look for the tell-tale signs: everything in one giant file, database queries inside loops, no caching, no background jobs for slow work. None of these matter at 10 users. All of them matter at 10,000 — and you’ll hit that wall right when you can least afford downtime.
5. Did the AI invent things that don’t exist?
Large language models hallucinate. In code, that shows up as calls to libraries that were never installed, functions that don’t exist, or logic that confidently handles a case incorrectly. Some of this the compiler catches. The dangerous part is the logic that runs fine but is subtly wrong — a tax calculation, a permissions rule, a data transformation. This is the failure mode that a human review catches and automated checks don’t.
6. Can anyone actually maintain it?
Ask the person who “built” it to explain how a specific feature works end to end. If they can’t — because the AI wrote it and they pasted it — you don’t own a codebase, you own a liability. Every future change will be slow, risky, and dependent on re-prompting an AI that no longer remembers the context.
7. What’s the dependency and licensing situation?
AI pulls in packages freely. Some are abandoned, some have known vulnerabilities, and some carry licenses that are incompatible with a commercial product. A quick audit of what you’re depending on — and whether any of it is a legal or security landmine — belongs on this list.
Solid, salvageable, or rebuild?
Most AI-built MVPs I review land in the middle: salvageable. The idea is proven, some of the code is fine, and a focused round of hardening — tests, auth, security, a bit of re-architecture — gets it to production-grade far cheaper than starting over. A smaller number are genuinely solid. A few are a rebuild, and knowing that before you pour six months of runway into scaling on a broken foundation is worth a lot.
The trap isn’t using AI to build. The trap is not knowing which of the three you’re holding.
If you’re about to scale, raise, or hand this code to a team, it’s worth an independent read before you commit. My AI code & build audit does exactly this — a plain-language verdict in 24 hours, from someone with no stake in the answer. Book a free intro call and I’ll tell you where you stand.