1. Security first
- No secrets in the code or browser. API keys, database passwords and payment credentials must live on the server in environment variables, never in front-end code.
- Access rules on every piece of data. Check that a logged-in user can only read and change their own records. AI-generated apps often forget this, and it's the most common serious flaw.
- Database security rules switched on if you use a hosted database. Default "open" settings are meant for testing only.
- Validate everything users send. Never trust form inputs, file uploads or URL parameters.
- Rate limits on login, sign-up and expensive actions to stop abuse.
- Dependencies updated and checked for known vulnerabilities.
2. Accounts and authentication
- Use a proven auth provider or library, not custom password code.
- Add email verification and secure password reset, or passwordless login. See passkeys.
- Separate admin accounts with extra protection.
3. Data you can't lose
- Automatic daily backups, and one test restore so you know they work.
- A proper database structure with constraints, not everything in one table or JSON blob.
- Separate test and live data, so experiments never touch real customers.
- A privacy policy that matches reality, and compliance with the data laws where your users live (e.g. GDPR in Europe, the Data Protection Act in Kenya).
4. Payments that reconcile
If you take money, use the payment provider's official SDK or API, confirm payments on the server through webhooks or callbacks (never trust the browser's "success" page), store every transaction ID, handle failures and refunds, and make sure every payment matches an order. For Kenyan apps, M-PESA STK push callbacks must be verified and matched to the right order every time.
5. Testing
- Automated tests for the core journeys: sign-up, login, the main action, payment.
- Run tests before every deploy so new AI-generated changes can't silently break old features.
- Test on real phones and slow connections, not just a fast laptop.
6. Hosting, deploys and monitoring
- Staging and production environments, so changes are tried before going live.
- One-click deploys and rollbacks.
- Error tracking that alerts you when users hit errors.
- Uptime monitoring for your site and API.
- Logs you can search when something goes wrong, without personal data in them.
7. Performance and SEO
- Compress images and load only what each page needs.
- Make sure public pages are crawlable HTML with proper titles and descriptions.
- Check mobile speed with Google PageSpeed Insights.
Rebuild or harden? If the core data structure and security model are sound, harden what you have. If every fix breaks something else, a clean rebuild using the prototype as the specification is often faster and cheaper.
What a production review looks like
- 1. Audit: security, data model, payments, hosting. You get a prioritised list of issues.
- 2. Fix the critical issues first: anything that could leak data or lose money.
- 3. Add tests and monitoring around the core journeys.
- 4. Set up proper deploys, then improve features with a safety net in place.
AI got you to a working product faster than ever. A focused production pass makes sure that product doesn't leak data, lose payments or break every time you change it. We review, harden and rebuild AI-built apps for founders and companies worldwide, working fixed-price or hourly from Nairobi.
See hire developers in Kenya, our custom software service, or read vibe coding vs hiring a developer.
