AI coding tools write code that runs. What they leave out is usually the work nobody asked for in the prompt. These are the ten risks we check for first.
1. Secrets committed to source code
API keys for AI providers, payment gateways and databases end up hard-coded or in a committed .env file. Even if they're deleted later, they stay in Git history. Fix: rotate every exposed key and move secrets to your platform's environment settings or a secrets manager.
2. Broken authorisation
Authentication (who you are) usually works. Authorisation (what you're allowed to see) often doesn't. Changing an ID in a URL or request can expose another customer's data. Fix: check ownership on every server-side query, and enable and test database access rules.
3. Trusting the client
Validation, pricing and permission checks get implemented in the browser, where users can bypass them. Fix: treat everything from the browser as untrusted and validate it on the server.
4. No CI/CD
Code is deployed by hand, with no automated build, tests or review. Every release is a gamble. Fix: a simple pipeline that builds, tests and deploys on merge to a protected main branch.
5. Untested backups
The hosting provider takes snapshots, but nobody has ever restored one. Recovery time is unknown. Fix: schedule a restore test and write down how long it took.
6. No monitoring or alerting
Errors and outages are discovered when customers complain. Fix: external uptime checks, error tracking and alerts routed to someone who will act on them.
7. Unbounded AI and cloud costs
AI API calls without limits, retries without backoff, and generous auto-scaling can turn a bug into a very large invoice. Fix: per-user rate limits, spend caps and budget alerts.
8. Outdated and unvetted dependencies
Generated code pulls in packages freely, sometimes outdated, sometimes abandoned, occasionally ones that don't exist at all. Fix: review the dependency list, enable automated vulnerability scanning and pin versions.
9. Sensitive data in logs
Debug logging added during development stays in production, writing tokens, passwords or personal information into logs. Fix: audit logging statements and redact sensitive fields. Under POPIA this matters.
10. Single-person (or single-chat) dependency
Nobody fully understands the architecture. The context lives in one founder's head or one AI chat history. Fix: a current architecture diagram, a README that explains how to run and deploy the system, and shared access to every critical account.
Every Bronkode Launch Check ends with your top 10 launch risks, ranked for your specific application.