Title: Your AI generated app works! Here’s what I would check before handing it over to a teammate

Getting your AI generated app to work is a great achievement but doesn’t mean someone else can reliably use it.

Before handing over a small internal tool, I would check 5 things. This is a practical checklist and doesn’t mean any scanner/test will prove it’s secure.

1. Secrets are not in your code

Before sharing a repo, search for any accidental secrets. Using a secret scanner such as Gitleaks can help identify likely secrets:

gitleaks detect --source . --verbose

Ensure you’re checking the latest documentation for the tool and how you have your repo setup. Even if you pass the scan, you should still check what has been found. Rotate any exposed secrets and provide secrets via the correct secret management/environment setup.

2. Who can do what?

Often a prototype will run using the developer’s permissions. Your teammate may not have these and shouldn’t automatically get them. Who is doing the action? What resource can they access? What happens if they can’t?

3. Test for failure

Try at least one of the following for all external dependencies:

• Request timeout
• API returns an error/unexpected response
• Incomplete/malformed input from user
• Remote service was successful but request timed out locally.

This is important as if you retry a non-idempotent action it could cause duplication. Where possible design for idempotency and test for retries.

4. Can they see what’s going on?

Can another developer see the logs? Understand what’s going on? Replicate the issue? Know what has changed? If the tool only works when the original author is looking at it, it’s not ready for a team.

5. How will you recover?

Before deployment, know how to turn off the tool, roll back the app version and recover from a bad change. You can’t roll back all external side effects such as sending a message or changing a record in code.

My standard is knowing what I have checked, what I haven’t checked and what the tool can affect if I get it wrong.

If you maintain internal tools, which check have you found to be the most expensive? Secrets, permissions, error handling, observability or recovery?

ai #webdev #security #testing