Are AI-built apps being deployed without production checks?
I’ve been noticing something interesting.
AI tools (Lovable, Replit, Cursor, etc.) are making it insanely easy to ship apps fast.
But I’m curious:
When you deploy something built primarily with AI, do you run any production-readiness checks?
Things like:
• CORS configuration
• Exposed API keys
• Basic rate limiting
• Auth edge cases
• Environment variable handling
Or do you just deploy and iterate?
I’m testing a small idea:
24-hour “production readiness audits” for AI-built apps (€29 while validating).
Trying to understand if this is solving a real problem or if people genuinely don’t care at this stage.
Would love honest feedback.
Trending on Indie Hackers
I had the same thought and considered this as a product idea. I think it certainly is a problem that needs some sort of easy solution, but i worry that there's no moat - there are Claude skills that focus on security etc already, and the coding agents are generally getting better at security anyway. So i would want to know - what is the difference between just getting an AI agent to do a security review and this product?
I think the real question for me isn’t whether AI can review code. It clearly can, and it’s getting better fast.
What I’m trying to explore is whether there’s room for something more opinionated and consistent. Not just “run a smart agent,” but a repeatable security baseline that always checks the same things, looks at deployed risk as well, and gives you a clear fix loop instead of just feedback.
If this ends up being just “AI security review as a service,” then I agree there’s no moat. It has to become more of a workflow layer around how AI-built apps are actually shipped.
Still very early, so I genuinely appreciate the pushback. It’s helpful.
I guess one problem might be - how can one product cover security positioning across disparate codebases, what sort of baseline can you use when the product being built could be literally anything? Then the answer likely falls back to AI, in which case the lack of moat is the problem again. Also, a lot of agenting coding is about building something fast so you can test it out, or maybe its a personal tool, but for these small experiments which i expect form a large % of vibe coded apps, security is not going to be a major factor at that stage. I do wish you the best with it though, it's an important problem to address. Did you talk to many users or potential users yet?
That’s a really good point.
The “disparate codebases” problem is exactly what makes this tricky. If an app can be literally anything, then the baseline can’t be super deep or stack-specific unless you narrow the scope. And if the answer is just “AI figures it out dynamically,” then yeah, we’re back to the moat question.
My current thinking is that the baseline wouldn’t try to understand every business logic nuance. It would focus on common failure patterns that show up across most AI-built apps. Things like auth gaps, open CORS, exposed env vars, overly permissive database policies, public debug routes, missing rate limits, that kind of thing. More guardrails than full audit.
On your second point, I agree that a lot of vibe coding is about fast experiments. Most people don’t care about security at that stage. But I’m starting to notice that many of these “quick experiments” end up being shared publicly, used by real users, or even connected to payments without much thought. That’s the gap I’m curious about.
I’ve had a few conversations but not nearly enough yet. Right now I’m still validating whether this is a real pain or just something that feels logical from the outside.
Appreciate you pushing on it. These are exactly the questions I need to answer.