From AI prototype to production: the checklist

Everything a generated app is usually missing before real users touch it — auth, data rules, states, performance and a way to roll back.

A prompt-built prototype is genuinely a product, right up until the moment a stranger uses it. This checklist covers the gap, in the order the gap usually hurts.

Data access rules

Enable row-level security on every table and write a policy per table. A generated app that reads fine in a demo often lets any authenticated user read every row.

Every state, not just the happy one

Loading, empty, error and permission-denied states for each screen. Empty states should explain the next action rather than announce that there is no data.

Secrets and server boundaries

Any key that can spend money belongs on the server. Grep the client bundle for the first eight characters of each key before launch — it takes a minute and occasionally saves a weekend.

Performance basics

Check the bundle size, lazy-load routes that are not the landing page, and paginate anything that could exceed a few hundred rows.

Accessibility pass

Real labels, visible focus, heading order, contrast, and a keyboard-only walkthrough of the primary flow. Generated markup is usually close but rarely finished.

A way back

Version control with meaningful commits, a database backup, and a deploy you can roll back. Without these, the first bad afternoon becomes the last one.