5 things I check before letting an AI-generated app touch production.

I spent years as an engineer and later led engineering at Replicate. AI has completely changed how quickly we can build software, but fast code generation doesn't automatically mean production-ready software.

These are the five things I check:

1 Can I explain the architecture?
I don't need to understand every line, but I should know how data flows, where business logic lives, and how the major pieces connect.

1. Can I break the happy path?
   I test failed requests, empty states, duplicate actions, refreshes, timeouts and unexpected inputs. AI is very good at making the happy path work.

2. Are permissions actually secure?
   Being logged in doesn't mean a user should have access to everything. I check authentication, authorization, database policies and whether users can access someone else's data.

3. What happens when something fails?
   APIs will timeout. Databases will have problems. Requests will fail. I want proper error handling, useful logs and sensible recovery instead of a blank screen.

4. What happens at 10x usage?
   I look for obvious problems like expensive database queries, unnecessary API calls, huge files and operations that could become expensive as usage grows.

I don't expect AI-generated software to be perfect.

The real question is whether the founder understands enough of what was built to operate it responsibly.
AI can absolutely help you ship production software.
But “the AI said it was finished” isn't a production checklist.