A non-technical founder's guide to knowing if your app is production-ready

You built something with Lovable or Cursor. It works when you click around. Now people want to sign up and pay, and you have no idea if it’s actually ready. You can’t read the code, so every answer sounds like a guess.

You don’t need to read code to judge this. You need to ask the right questions and know what a good answer sounds like. Here’s the checklist I’d use.

Questions you can ask without knowing how to code

Each of these is something you can ask a developer, a contractor, or even the AI tool that built the app. I’ve written what a safe answer looks like next to each one.

1. “What happens if the database gets deleted right now?”

Safe answer: “We restore from last night’s backup and lose at most a few hours.” Bad answer: “That won’t happen” or a long pause. If nobody can tell you how to get your data back, you don’t have backups. You have a single copy of everything, and one bad click ends the company.

2. “Have you ever done a test restore?”

A backup you’ve never restored is a rumor. The only way to know a backup works is to rebuild the app from it and watch it come back. Ask when the last test restore was. “Never” means the backups are unproven.

3. “Are any passwords or keys written directly in the code?”

AI tools love to paste API keys straight into files. If your Stripe key, database password, or email-sending key is sitting in the code, anyone who sees the code can spend your money or read your data. Safe answer: “All secrets are in environment variables, not in the code.” If you want to check one thing yourself, read our 5-minute exposed-keys check.

4. “Can one user see another user’s data?”

This is the scariest one for AI-built apps. Many of them ship with a database that has no rules about who can read what. That means user A can sometimes load user B’s private records just by changing a number in the address bar. Ask directly: “Is row-level security turned on, and has someone tested that user A can’t see user B’s stuff?”

5. “What happens when 100 people use it at the same time?”

Free database tiers often allow only a handful of connections at once. Hit the limit and everyone gets errors. You don’t need to understand the details. You just need to know someone has thought about it and has a number in mind.

6. “Where does the app run, and what happens if that provider disappears?”

Some AI builders host your app on their own platform. That’s fine until you outgrow it or they change their pricing. Ask if you can export the code and the database and run it somewhere else. If the answer is no, you’re locked in.

7. “If the app goes down at 3am, how do we find out?”

Safe answer: “We get an alert on our phone within a few minutes.” Bad answer: “A customer emails us.” Without monitoring, your first sign of an outage is an angry user, and by then you’ve already lost trust.

8. “Is this legal for the users we’re targeting?”

If you’re taking data from people in the EU, GDPR applies to you even if you’re a solo founder. That means knowing where the data is stored, having a privacy policy that’s true, and being able to delete someone’s data if they ask. This doesn’t need a lawyer on day one, but it needs an honest answer.

The traffic-light version

If you want to keep it simple, sort every answer into three buckets.

• Green: backups exist and have been tested, no secrets in the code, users can’t see each other’s data, you get alerts when things break.
• Yellow: it works but one or two of the above are shaky. Fixable in days, not months. Launch to a small group, not the world.
• Red: no backups, secrets in the code, or users can read each other’s data. Do not put real people’s data in this yet.

Most AI-built apps I see are yellow with one or two red items hiding in them. That’s normal. The prototype did its job by proving people want the thing. Now it needs a few days of unglamorous work before strangers trust it with their data and their money.

For a more technical version of this list that a developer can work through line by line, see our production checklist for Lovable apps.

Or, we do it for you

If you’d rather not run the interrogation yourself, we’ll do it for you. Our free audit checks your app for the exact problems above and tells you, in plain language, which bucket you’re in and what to fix first.

FAQ

I can’t read code. Am I being irresponsible launching anyway?

No. Plenty of good businesses started with founders who couldn’t code. Being responsible means knowing what you don’t know and asking for a check before real users trust you with their data. That’s what this list is for.

How much of this can I check myself?

The exposed-keys check and “can user A see user B’s data” you can often test yourself by clicking around and changing values in the address bar. The rest usually needs someone who can read the code or an automated scan. You don’t have to fix them yourself, you just have to know they’ve been checked.

My AI tool says the app is “production ready.” Can I trust that?

Treat it like a salesperson describing their own product. The phrase “production ready” has no fixed meaning. Ask the specific questions above instead, because “yes it’s ready” and “yes, backups are tested and users can’t see each other’s data” are very different claims.

What’s the single most important item on this list?

Whether one user can see another user’s data. A crash annoys people. A leak of private data can end your company and trigger legal penalties. If you only check one thing, check that.