App Health · Free

AI-built app production checklist

What to verify before you put a generated codebase in front of real users — because the boring items are the expensive ones.

Run the free app health checkRuns in about a minute · no card, no install

The tools are not the problem. AI builders produce genuinely good code, often faster and cleaner than a mid-level contractor would hand you in three weeks. The risk is that they produce code optimised for the demo path — one user, one happy sequence, one clean input — and then present the result with the same visual polish a battle-tested application would have. There is no cosmetic difference between an app that survives contact with the public and one that does not. Both look finished.

So the job here is not “check whether the AI did a bad job”. It is “check the specific set of things that AI-generated code is structurally likely to skip”. Those are different tasks, and the second one is highly predictable — which is why a checklist works at all.

Budget half a day. Go in order. Do not skip the boring ones; the boring ones are the expensive ones.

You are probably here because

You built the app by prompting and you have never audited the output.
You are the only person who has ever used it and you are about to change that.
You have tested the happy path but never the second identical request, the empty state, or a hostile user.
You are about to take payments, or store data that belongs to more than one person.

What the check looks at

Read back every write — fetch the record you just wrote and compare it field by field, because generated code assumes success and silent partial writes are common
Test the second identical event, not the first — duplicate submits, retried webhooks and repeated payment confirmations need an idempotency key, not a happy path run once
Run the app against an empty database — sample-data assumptions break dashboards, charts and welcome-back screens the moment your first real user arrives
Hunt N+1 queries — a 50-item list that fires 51 queries feels fast at 10 records and falls over at 10,000
Confirm indexes on every column you filter, sort or join on — generated schemas define the tables correctly and then never add them
Enforce upload limits and run a basic load test — an unrestricted upload endpoint is both a stability and a security problem
Validate price server-side, always — look the price up from your own database by product ID and ignore any amount the client claims
Verify, dedupe and sign webhooks — providers retry by design, so the endpoint must tolerate the same event twice without double-fulfilling
Manually test permission boundaries — log in as one user, change a record ID in the URL to another user’s, and confirm you cannot see their data (IDOR)
Search your deployed bundle for secrets — grep the shipped JavaScript for key, secret, token, sk_ and Bearer; anything in the browser is public
Confirm backups actually restore — an untested backup is not a backup, it is a belief about a backup; restore one to a scratch environment and check the data is intact

How it works

Paste your URL

No install, no repo access, no credit card. The check runs against your live site exactly as a visitor or crawler sees it.

Get a scored breakdown

Every dimension is scored and weighted, so you can see which single issue is costing you the most rather than staring at a flat list of warnings.

Keep the report

You get a shareable results link and a downloadable report you can hand to a developer, a client, or a buyer asking hard questions.

Work the list, write down what fails, and fix in order of blast radius: data exposure first, money second, data loss third, performance fourth. Then run it again after any significant regeneration — every substantial AI-driven change is a new codebase wearing the old one’s clothes, and the assumptions you verified last month may quietly no longer hold. Building is close to free now; the value you add is verification.

Run it on your own site

You get a score, the specific findings, and a report you keep — whether or not you ever talk to us.

Run the free app health check

Questions

Why does AI-generated code need a production checklist at all?

Because AI builders are extraordinary at the expected path and systematically weak on everything adjacent to it — the second identical request, the empty state, the missing dependency, the hostile user, the ten-thousandth row. Those are not exotic scenarios; they are the ordinary texture of software that has real users.

What is the single most dangerous item to skip?

Server-side price validation and permission boundaries. If the amount charged originates in the browser, someone will eventually send amount: 1 and buy your product for a penny; if a route trusts a record ID without checking ownership, one user can read another’s data. Both are routine attacks, not hypotheticals.

How do I check for exposed secrets myself?

Open your deployed JavaScript bundle and search it for key, secret, token, password, sk_ and Bearer. Anything shipped to the browser is public — there is no hidden value in client-side code. If you find a service key, treat it as compromised, rotate it, and move that logic server-side.

How often should I run this?

Once before launch, and again after any significant regeneration. A large AI-driven change effectively hands you a new codebase, so the ownership checks, indexes and idempotency you verified last month may no longer hold.

Related free checks

Security & Compliance