Checklist
Prototype to Production: The 12-Point Checklist
Twelve things that separate a prototype from software people can depend on — the list we run through before any AI-built app is allowed to take real payments.
This is the list we actually run. It is not exhaustive; it is the twelve items that catch what breaks first, roughly in the order they bite.
Data
- Migrations exist. Schema changes are files in the repo, not something typed into a console at midnight.
- Constraints are real. Foreign keys, unique indexes, not-null. If the database will not accept nonsense, half your bugs never happen.
- Backups are restored, not just taken. A backup nobody has restored is a rumour.
Identity
- Sessions expire and refresh without logging out someone mid-checkout.
- Authorisation is checked server-side on every request. Hiding a button is not security.
- Password reset works for someone who signed up with a typo'd email.
Money
- Payment and order are reconciled. A webhook can arrive twice or never; both must end in the correct state.
- Invoices are correct at the first order — for India that means CGST/SGST or IGST and an HSN code, generated automatically.
Running it
- You find out before your users do. Error tracking and uptime monitoring, with alerts that reach a human.
- Deploys are boring. One command, repeatable, and a way back.
- The slow queries are known. Someone has run the app against realistic data volumes, not five test rows.
- You own everything. Repo, hosting, domain, database, in your accounts.
How long closing the gap takes
| Starting point | Typical work | Time |
|---|---|---|
| Prototype, no users | Data layer + auth | 1–2 sprints |
| Live, few paying users | Above + payments reconciliation + monitoring | 2–4 sprints |
| Growing, breaking weekly | Above + query work + deploy pipeline | 4–6 sprints |
We quote this fixed-price after reading the code — a half-hour job. If it is already fine, that is what we will tell you.
Questions
Can you audit an existing app without rebuilding it?
Yes. A 30-minute read gives you the list of what would break first and a fixed price for each item. Plenty of clients take that list and fix it themselves.
What breaks most often in AI-generated apps?
In our experience: missing database indexes, authorisation checked only in the interface, and payment webhooks that are not idempotent — a duplicate webhook creates a duplicate order.
