AI tools will get you a working site or application in a weekend. What they will not tell you is what is still exposed, what falls over the moment real people use it, and what it takes to keep running.
None of this is a criticism of how you built it.
These tools are good, and they get noticeably better every few months. I use them every day in my own work and would not want to go back.
Where they are still weak is the part nobody sees. They are built to produce something that runs, and they will quite happily leave a key in plain sight or a database open to anyone who asks for it.
So the distance between something that works for you and something that can be trusted with other people’s money and data is real. It is also specific, and all of it is checkable.
Every API key, password and token, and whether any of them are sitting somewhere the public can reach. Anything shipped to the browser counts as public, however it was stored.
The most common fault in a generated app: logins that are checked in the browser only, or database rules left open so one account can read everybody else’s records.
What you collect, where it lives, who can reach it and how long you keep it. Along with the privacy terms you are legally required to have once you start collecting it.
Payments verified on the server rather than trusted from the page, and spending limits on anything billed per use, so a loop or a bot cannot run up the account.
Most prototypes are only ever used by the person who built them. What happens with fifty people at once, bad input, slow connections and someone pressing the button twice.
Duplicated logic, dead files, queries run in a loop and pages shipping far more than they need. Each one costs speed, hosting and the time of whoever edits it next.
Generated projects collect packages quickly. Which ones are actually used, which are abandoned, which carry known vulnerabilities and which have licences you would rather not inherit.
Domain, hosting, repository and service accounts in your name, with a separate place to test changes before they reach the people using it.
Where the database is backed up to, how far back it goes, and a restore actually performed once so you know it works and how long it takes.
Error tracking, uptime checks and a basic record of what happened, so you hear about a problem from a screen rather than from a customer.
Bots scan public code and shipped pages continuously. A working key gets used on your account and billed to your card, often long before anything looks wrong on the site itself.
POPIA requires you to tell the Information Regulator and every person affected. Administrative fines run to R10 million, and anyone harmed can claim damages without proving you were careless.
It shows up in the hosting bill, in visitors who leave before a page loads, and in what every future change costs, because the next person has to understand it before touching it.
Dependencies get patched, browsers move on and the services you call change their rules. Software that is left alone does not stay still, it quietly stops working.