GalaxyTechnology
Self-check · November 2026

Is your AI-built app ready for real customers?

AI tools (Lovable, Bolt, Replit, Cursor) get you to a working demo fast. The last part — keeping real customers, real money and personal data safe — is where they stall. Answer ten questions to see how exposed your app is before you let real users near it.

Answer for the app you're closest to launching. If you're not sure, choose "Don't know" — that's useful information in itself. Your answers stay in your browser: nothing is sent or stored.

1. Does the app handle real customer data, logins or payments?
2. If more than one customer uses it, is each customer's data provably separated in the database (not just hidden in the interface)?
3. Could sign-up, access limits or payment be bypassed by calling the API directly, rather than going through the screens?
4. If you take payments, are the payment provider's webhooks verified and safe to receive more than once?
5. Are any API keys or secrets present in the browser code or a public repository?
6. If the app calls an AI or other paid API, is there a spend cap or rate limit so a loop or a bad actor can't run up a huge bill?
7. Can a customer's personal data be found and deleted on request (UK GDPR)?
8. Are the main things the app does covered by automated tests?
9. Is there a staging environment and a safe, repeatable way to deploy — rather than editing the live app?
10. Are there backups of the database, and has a restore ever been tested?

What the questions are looking for

  • Who's exposed: whether real customers, money or personal data are involved (question 1).
  • The big three in AI-built apps: data separation between customers, access and payment that can't be bypassed, and secrets kept out of the browser (questions 2, 3, 4, 5).
  • Runaway cost and the law: spend caps on paid APIs and the ability to delete personal data (questions 6, 7).
  • Safe to change: tests, staging, deployment and backups (questions 8, 9, 10).

For the background, read getting an AI-built app ready for real customers, or see the AI-built app rescue service.