Tools like Lovable, Bolt and Replit can help you build an app fast, but are you sure it’s safe to launch? These ten questions can help you launch your AI-built app confidently.
The 10 questions to ask before you launch your app
1. Can one customer ever see another customer’s data?
A leak between accounts does the most damage of any failure.
A good answer sounds like: “We have tests that prove this can’t happen.”
2. Where are the access rules enforced: on the screen, or on the server?
Anyone who knows how to call the app directly can bypass rules that live only on the screen.
A good answer sounds like: “The server (or database) enforces them, and tests run against the real database, not a copy of the screen’s rules.”
3. Can the lowest-level user do anything an admin should do?
AI-built apps often grant too much by default, and an ordinary user quietly gets write access.
A good answer sounds like: “We have a list of roles and what each can do, and each one is tested.”
4. When someone edits the app, does the change go straight to your live site?
An edit at 5pm on a Friday can break a customer demo before anyone reviews it.
A good answer sounds like: “Changes are reviewed and released in one controlled step, and we can roll back.”
5. Could you rebuild the database from scratch, and have you restored a backup?
If the database only exists as clicks in a tool, you can’t undo one bad change.
A good answer sounds like: “The history is in version control, and we’ve rebuilt it and restored a backup at least once.”
6. Would you know if something broke at 2am?
With no monitoring, customers are the alarm system.
A good answer sounds like: “Errors and failed jobs alert a named person, and we can see what happened.”
7. Do notifications and emails actually arrive?
Silent failures are common: alerts stop sending and nobody notices for weeks.
A good answer sounds like: “We track delivery, handle bounces, and verify incoming messages are really from our provider.”
8. What happens with ten times the data or users?
Screens that load every record at once feel fine at 20 customers and fall over at 200.
A good answer sounds like: “We tested with realistic volume, and lists load a page at a time.”
9. Who owns the keys: hosting, database, domain, code, passwords?
If the builder leaves, or an account sits in their name, you may not be able to get in.
A good answer sounds like: “Every account is in the company’s name, and secrets are stored safely, not in the code.”
10. Are there automated tests on the parts that handle access, money and data?
Without tests, every new change is a gamble on what it silently breaks.
A good answer sounds like: “Tests run before each release, and the risky areas have the most coverage.”
When to pause the launch
If you answer questions 1, 2 or 3 with “I don’t know”, pause before putting real customer data in the app. You can’t fix those three with an apology afterwards. Answering “I don’t know” on the others means a plan is needed, not that the launch is off.
These questions come from 21 years of experience building software applications. I’ve used them to review live AI-built apps, finding and fixing the gaps before launch. If you’re not sure how to answer these questions, or address them if they make you nervous, I do a short, fixed-price reviews and will tell you plainly where your app stands.