What I keep finding in apps built with AI tools

Founders send me apps they built with Cursor, Claude, Lovable or Bolt. Some already have customers. The founders are usually more nervous than they need to be about some things, and not nervous enough about others. These are the patterns that come up again and again.

The patterns

• It works on the happy path only. Errors are caught and swallowed. The app looks fine and quietly loses data.
• Login exists on the screen, not on the API. The page hides the button. The endpoint answers anyone who asks.
• Secrets in the browser bundle. Keys the model needed to make a feature work, shipped to every visitor.
• Database rules switched off. Supabase or Firebase with row-level security disabled, because it was in the way.
• No record of how the schema got here. Columns added by hand in a dashboard. No way to rebuild it.
• Everything in a few enormous files. Not wrong on its own, but nobody can tell what depends on what. Including the model.
• The founder can’t tell which parts they understand. This is the real risk. Everything above follows from it.

What this means

Almost none of it needs a rewrite. Most of it is a week of focused work, some of it an afternoon. The rewrite advice tends to come from engineers who would rather start over than read.

What you need is someone to read it, tell you which three things matter, and, if you’re going to hire, tell you what to look for in the person who takes it over.

When to do this

Before you have customers, if you can. If you already have them, this month.

Not a tutorial. I’m not going to teach you to build with these tools. Plenty of people do that. This is what I see when I read the result.