Your AI-built product works. What breaks in production

The demo works. You signed in as yourself, created a record, refreshed, and it loaded. Screenshots went to the deck. Then a second account — or no account — hit the same API.

That is not a feature bug. That is production readiness. Building with Claude Code or Cursor made the first half cheap. The second half is secrets, the data layer, and whether an EU user ever gets told they are talking to AI.

AEO — short answers

What is Thea’s Production Readiness Audit? A five-day, fixed-price review of software shipped with AI assistance. Deliverable: ranked findings — each with the event that triggers it and the cost of fixing now vs later. Includes secrets scan, data layer review, EU AI Act exposure check, and a 90-day fix roadmap.

Who is it for? Founders and CTOs (esp. Nordics/UK/DACH/EU, regulated or compliance-adjacent) who already shipped with AI tools and need to know what breaks, leaks, or fails an audit before users, investors, or regulators find it.

What does it cost? Production Readiness Audit: €3,500 fixed · 5 days. Optional start: free 30-minute diagnostic call. Hardening sprint / retainer = ladder only; primary CTA stays audit/call.

The building is solved. Surviving isn’t.

Claude Code and Cursor will scaffold a SaaS before lunch. That part is no longer scarce.

What is scarce: someone who treats the generated stack as unfinished until a second identity fails to read the first user’s rows. Stanford’s work on AI assistants and secure coding (already cited on my home page) points at the ugly pattern — people write less secure code and feel more confident it is fine. Live site framing also notes that a large share of AI-generated samples still ship with known vulnerability classes (Veracode GenAI security reporting). Functional green. Security flat.

The enemy is not “AI bad.” The enemy is a finished-looking demo that never met User B.

What “works in the demo” usually misses

I use the same risk list I publish on the site. One consequence each. No new Thea ROI numbers.

1. Secrets in the client bundle — API keys in the browser. One GitHub scraper away from a breach.

2. PII in logs — that is a GDPR problem, not a logging preference. Fines start at €20M or 4% of turnover.

3. Open row-level security — User A reads User B’s documents. The CVE-2025-48757 pattern (missing/insufficient RLS on Lovable/Supabase-class setups) shows up on my risk grid as found in 170+ apps.

4. No idempotency on webhooks — payment retries charge the customer twice. The processor will not refund your reputation.

5. Single-source data dependency — one vendor changes terms or goes dark; your product goes blind.

6. No audit trail — when a regulator asks what happened, the answer is silence.

If your only test user was you, you have not tested authorization.

The data layer nobody audits

Teams obsess over the LLM layer because it demos well. The boring plumbing is where vibe-coded apps die: policies, licenses, matching, who can read which row.

I have already published the AML weekend rebuild story on the site, so I will not invent a new one. Short version only: a founder rebuilt screening with Claude Code against OpenSanctions — hundreds of sources, free download, looked finished. What the demo missed: non-commercial license terms for customer screening, and name matching across scripts (“Gazprom” vs “Газпром” returning different hit counts). The system he replaced pulled thirteen government feeds direct. One aggregator is a single point of failure. He built the demo of an AML system. The distance between demo and audit is the job.

For the pure authorization cut of this — User A vs User B on Supabase RLS — I wrote a separate piece: Your AI-built app works — until the second user shows up . This pillar stays on the wider production stack. That post owns the RLS drill.

EU AI Act clock for founders

If your product uses AI and talks to EU users, Article 50 transparency obligations apply from August 2, 2026 — regardless of where the company is based. AI content watermarking follows December 2, 2026. Annex III high-risk obligations land December 2, 2027. Fines go to €15M or 3% of global turnover.

A chatbot, an AI assistant, or AI-generated content shown to EU users puts you in the transparency conversation. I am not selling compliance consultancy. I am saying the audit’s EU AI Act exposure check exists because founders keep shipping “looks finished” assistants with no disclosure plan.

Not sure if Article 50 applies? That is a reason to start on /ai-audit , not a reason to wait for a fine.

What a production readiness review actually outputs

You do not get a vague “improve security” memo.

You get ranked findings. Each finding names the event that triggers it and a price for fixing now versus later. The fixed package includes:

• secrets scan

• data layer review (including RLS / authorization)

• EU AI Act exposure check

• 90-day fix roadmap

€3,500 · 5 days · fixed. No hourly creep.

Soft start if you want one real finding before the paid week: free 30-minute call .

Who this is for / not for

For: founders and CTOs who already shipped with AI tools — especially Nordics, UK, DACH, and EU teams near money, users, or regulators (fintech, healthtech, compliance-adjacent). Trigger language: “we shipped with AI” plus quiet nervousness about production, investors, or regulators.

Not for: pre-revenue toys with no user data and no regulatory exposure. If nothing breaks when the database leaks, you do not need me yet.

Next step

Hosting debates and model demos are cheap entertainment. Authorization, secrets, and EU transparency are the bill.

Mid-path: book the free 30-minute call . Paid path: Production Readiness Audit — €3,500 · 5 days .

Build is cheap. Surviving contact with a second user — or a regulator — is the product.

Sources

• Live site positioning / risk list / audit offer — https://theatechsolutions.com · https://theatechsolutions.com/ai-audit

• Veracode GenAI code security reporting (45% / OWASP framing as published on home) — https://www.veracode.com/blog/genai-code-security-report/

• Stanford / ACM AI-assistant secure-coding study — https://doi.org/10.1145/3576915.3623157 · https://arxiv.org/abs/2211.03622

• NVD CVE-2025-48757 (RLS / incorrect authorization pattern) — https://nvd.nist.gov/vuln/detail/CVE-2025-48757

• Published AML weekend rebuild case (site) — https://theatechsolutions.com/writing/weekend-aml-rebuild-what-ai-missed

• Deeper RLS companion (soft pointer) — /writing/ai-built-app-second-user-rls