You built an app with AI and people use it. Now what?
You built an app with AI tools and people now use it. Good. Before you add anything else, do four things: find out where your secrets live, restore a backup to prove it works, put tests around signup and payments, and get one experienced engineer to read the code. Everything else can wait.
The four checks, in order
Secrets first. Search the repo and its whole git history for API keys, database passwords and tokens. AI assistants like inlining credentials to make things work quickly. Anything you find gets rotated today. Deleting the line is not enough, because the history keeps a copy.
Then backups. A backup you have never restored is a guess. Restore one into a scratch environment and time it. Then tests, but only where it hurts: signup, login, payment, and whatever your users would shout about losing. Then one read-through from someone who fixes production systems for a living, while the problems are still cheap to fix.
Why every change feels dangerous
AI assistants solve the request in front of them. Over hundreds of prompts, that leaves duplicated logic, dead code and hidden connections between files. The same rule ends up written in three places, and now all three have to change together. That is why a one line fix breaks something on the other side of the app.
The app is not fragile because AI wrote it. It is fragile because nobody has pruned what all those prompts left behind. The way out is not a rewrite. Rewrites kill more working products than bugs do. Stabilise it with tests and monitoring, then simplify the worst parts one at a time while it keeps running.
When to bring in an engineer
The trigger is simple: real money or real users now depend on it. Ask for three things. A written health check in plain English that says what is solid, what is fragile and what is dangerous. A fixed price stabilisation plan with the risks ranked. Only after that, a decision about ongoing help. Anyone who says the whole thing needs rewriting before they have read it is selling, not diagnosing.
Keep ownership of everything: your repo, your accounts, your keys. A good engagement leaves you more in control of your own product, not less.
// from fulcrum
Get a free Code Health Check