Tools like Cursor, Claude Code, Lovable, Bolt and Replit have changed how quickly an idea can become something you can click on. A founder with no engineering background can now describe an app and have a working prototype by the end of the afternoon. That's a genuine shift, and I use these tools myself every day.
But a prototype that works on your screen is not the same as a product that works for hundreds of people, keeps their data safe and can be changed next month without breaking. The gap between the two is software engineering — and it doesn't disappear just because the code was generated.
What usually goes wrong
When I review AI-built applications, the same issues come up again and again.
Secrets in the wrong place. API keys hardcoded in frontend files, database credentials committed to the repository, or admin endpoints with no authentication at all. These are easy to miss because the app works perfectly — until someone else finds them.
Logic that only works on the happy path. The demo flow works, but what happens when a payment fails, a user double-clicks a button, or two people edit the same record? Generated code tends to handle the case you described, not the ten cases you didn't.
A structure that fights every change. Each prompt adds a little more code in whichever file seemed convenient. After a few weeks, a small change in one place breaks something unrelated, and the AI starts fixing its own fixes.
No path to production. Environment variables, database migrations, backups, error monitoring, a deployment process you can repeat — none of it appears unless someone asks for it specifically.
AI is a fast builder, not an accountable one
The tools are excellent at producing code. What they don't do is take responsibility for the system as a whole: deciding what should exist, how the parts fit together, what could fail, and what the business can afford to get wrong.
That's the part of the job that experience covers. Knowing which shortcuts are harmless in an MVP and which ones will become expensive. Recognizing a security pattern before it turns into an incident. Structuring the code so the next feature is easier to add, not harder.
What to do if you've built something with AI
You don't need to throw it away. In most cases the right move is:
- Get an honest review. Understand what's solid, what's risky and what's missing before you invite real users.
- Fix the critical issues first. Security, data integrity and deployment come before new features.
- Put structure around it. A clear folder layout, consistent patterns and basic tests make it possible to keep using AI tools productively.
- Launch properly. A repeatable deployment, monitoring and backups — the boring parts that let you sleep.
AI has made building software faster. It hasn't made engineering optional. The best results I see come from combining both: let the tools do the typing, and make sure someone experienced is making the decisions.