AI-assisted development can accelerate a prototype, especially when the product flow is still being explored. A working screen is useful evidence, but it is not proof that the application is ready to hold customer data, perform sensitive actions, or be maintained by the next engineer. Production readiness is a set of concrete behaviours, not a label.
Review the boundaries first
Start where an application accepts or exposes information: authentication, authorization, password and session handling, API endpoints, file upload, administrative actions, and secrets. Ask which user roles can reach each action, what data is changed, and what happens when a request fails halfway through.
Generated code often looks internally consistent while making assumptions about the surrounding platform. Verify those assumptions against the actual database, deployment environment, identity provider, and third-party services in use.
Protect the data lifecycle
Review migrations, backups, destructive operations, and environment configuration. A migration should have a clear order, a verified target environment, and an understood recovery path. Avoid treating local database success as evidence that production data can be changed safely.
Also trace input validation and error behaviour. Good errors help users recover without exposing implementation details. Good logs give operators enough context to investigate without collecting credentials or sensitive data unnecessarily.
Create foundations for future change
You do not need a huge test suite before every release, but the critical user and business flows need a repeatable check. Add focused tests around authorization, data transformations, payment or integration boundaries, and regressions already discovered. Document how the project runs, how it is deployed, and what configuration it requires.
Hardening checklist
- Authentication and authorization rules are explicit for each important workflow.
- Secrets, configuration, and environment differences are not embedded in source code.
- Database migrations have an order, a verification step, and a recovery plan.
- Failures produce useful, safe logs and understandable user-facing handling.
- Critical paths have focused automated or documented manual checks.
- Deployment steps and operational ownership are documented for the next developer.
Hardening is an honest assessment followed by useful increments. If you have an AI-built or inherited application that needs a responsible path to production, see AI-Built App Hardening.