Seven Signs Your AI-Built App Needs an Engineer
AI-Built Software · Where DIY Stops · Seven Signs
Where Building With AI Stops Working: Seven Signs
AI tools can get you to a working app in a weekend. That is genuinely new and it is a good thing. It is also where the trouble starts, because "it works on my screen" and "it holds up with real users" are two different jobs. Most advice on this is a ten-step checklist of tools. This page is different: it names the specific signs that DIY has run out, in the words founders use when they call us, and says what each one costs to deal with now versus later.
Can we just keep prompting our way through it?
Do we have to throw it away and start over?
How urgent is it?
Is this only about security?
Is This the Right Page for You?
This is for you if: a working prototype exists (built in Lovable, Replit, Bolt.new, v0, Cursor, Bubble or a similar tool) and real people or real data are starting to touch it.
This is not for you if: you are still deciding what to build. Start with scoping a software project.
Is This a Real Problem, or Is It Hype?
It is measurable. Veracode's GenAI Code Security Report (October 2025) tested code from more than 100 language models across Java, JavaScript, Python and C#, and found that AI-generated code introduced risky security flaws in 45% of tests. Its March 2026 update found the security pass rate is still around 55%, virtually unchanged from two years earlier, while syntax correctness has climbed above 95%. Models have become very good at code that runs. They have not become better at code that is safe.
A prototype that runs is not evidence that it is safe, and nobody can tell the difference by clicking around.
Count how many describe your app
What Are the Seven Signs?
1. Real people depend on it now
It started as a demo. Customers or staff are running their day on it.
Now: a short review finds the risks. Later: an outage during a busy week.
2. Nobody is sure how to deploy it
The person who built it has moved on, or the process is a set of steps someone remembers.
Now: write the deploy path and automate it. Later: every change is a gamble and you stop making changes.
3. There is no login or access model
Anyone with the link can see everything, or everyone shares one account.
Now: add roles and least-privilege access, usually in place. Later: a data exposure, and a difficult conversation with a customer.
4. Credentials live in the code
API keys and passwords sit in the repository or in the browser.
Now: move secrets out and rotate them. Later: anyone who has ever seen the code has the keys.
5. It has fallen over once and nobody knows why
It came back. Nobody can say whether it will happen again, because there is no monitoring.
Now: add alerts so you hear from a monitor, not a customer. Later: downtime you learn about from customers.
6. There are no tests
Every change risks silently breaking something else, so changes get slower and scarier.
Now: add tests around the parts that make money. Later: you stop shipping.
7. Nobody can answer "is our data safe?"
Someone with authority, a customer, an investor or a board member, has started asking.
Now: an independent review you can hand them. Later: a deal or a customer waiting on an answer you cannot give.
What Does Your Count Mean?
| Signs | What it usually means | First step |
|---|---|---|
| 0 to 1 | You are early. Prompting is fine on a sound foundation. | Keep building. Review before real users arrive. |
| 2 to 3 | The gaps are real and fixable, usually in place. | A production review: harden or rebuild |
| 4 or more | The foundation may not carry real load. | A Production Spec: findings, a risk ranking, an estimate |
Why does this happen?
It Is the Shape of the Tools, Not Your Team.
AI makes the visible parts nearly free. It leaves out the parts nobody sees until they fail.
What AI makes nearly free
- A working demo
- A first-pass interface
- Glue code
What it leaves out
- An access model
- Tests, monitoring and a deploy path
- Architecture a second engineer can own
Those are not things you prompt into existence one screen at a time.
Who Should Own the Technical Decisions?
If nobody on your team can judge architecture, that is the first thing to fix, before more code. Somebody has to own the technical decisions, whether that is a hire, a fractional CTO or an engineering firm. See fractional CTO for an AI-built product for how that works with us.
Find out before you build more
What Does It Cost to Find Out?
A Production Spec is $2,500 fixed. It checks your app against seven production-readiness dimensions (security and access, data integrity, architecture, test coverage, observability, a real deploy path and documented ownership), ranks the risks and gives you an honest harden-or-rebuild call. The document is yours whether or not you hire us.
Production Spec
Start hereTime-boxed
We check what you have built and tell you what it takes to make it hold.
- Checked against seven production-readiness dimensions
- The risks, ranked
- An honest harden-or-rebuild call
- Yours whether or not you hire us
Free Consultation
Bring what you have built. You will leave knowing whether it is worth a Production Spec, before you spend a dollar.
- A senior person, not a sales rep
- A straight answer on fit
- A scoped next step and what it costs
Questions We Get Before the Call
No. Security is the sign that gets attention. Deploys, monitoring and tests decide whether you can keep changing the product.
Related
Vibe-coded app to production, harden or rebuild and what it costs to take an AI-built prototype to production. Comparing firms? Who takes a vibe-coded app to production.
Sources: Veracode, 2025 GenAI Code Security Report (October 2025 update) and Spring 2026 GenAI Code Security Update (24 March 2026).
Pick your next step
Start With a Conversation. It Costs Nothing.
Every engagement begins the same way, with a free consultation. You will leave it with an honest recommendation, including the recommendation not to build.
Free consultation
A working session with a senior person, not a sales rep. Always the first step.
Fixed-price Production Spec
We check what you have built, rank the risks and return a real estimate. Fixed at $2,500.
Read the proof first
Not ready to talk? See what we have actually shipped.