AI and product quality
Vibe coding with AI: from prototype to reliable app
AI can produce a working prototype quickly. Here is how to assess code, security and user experience before inviting real users.
The short answer
Treat AI-generated code as a proposal that needs understanding and review. Prioritise data access, dependable user journeys, cost control and the ability to fix problems. A successful demo is the beginning of quality assurance.
1. Give AI a small, clear task
Vibe coding usually means creating software by describing a result to AI and iterating on its output. It can be an effective way to explore. Trouble starts when the project grows faster than your understanding of how it works.
Describe one user journey at a time, including the expected result and failure cases. Ask for a short explanation of a change before accepting it. Keep a working baseline in version control so you can go back when a new solution introduces more problems than it solves.
Avoid long cycles in which AI changes increasingly large parts of the code to fix one defect. Stop, reproduce the issue and narrow down the cause. A small, understood intervention is often easier to verify than another rewrite.
2. Check who can do what
Authentication and authorisation solve different problems. A signed-in person should not automatically be able to read or modify another user’s data. Hiding a button in the interface does not enforce access control.
Verify that permissions are enforced by the server or database. With Firestore, security rules restrict client access; server libraries use a different access model. Test with two accounts and without signing in, not just with your own administrator account.
- Can user A read, change or delete information belonging to user B?
- Can someone bypass the screen by sending a request directly?
- Are private API credentials or service accounts included in client code?
3. Test when real life breaks the script
An app working on your phone and network has passed one situation. Try a slow connection, interrupted requests, empty lists, expired sessions and larger data sets. Tap a button twice. Restart the app halfway through a task.
Critical actions such as payments and bookings should handle retries without duplicate outcomes. Add meaningful automated tests around the areas where failure would hurt most. Combine them with manual testing of complete journeys on real devices.
4. Understand operations, dependencies and costs
Document the services the app uses, who owns the accounts and how to set the project up again. Review dependencies and licences. Make sure failures can be detected before an unhappy user has to tell you about them.
If the app itself uses AI, limit abuse, control request sizes and track cost per useful action. Treat model output as untrusted input before allowing it to affect stored data or trigger actions.
Plan backups and test whether important data can be restored. Keep a route back to a previous release as well. Choose these safeguards around the consequences of failure, not around how easily the first version started running.
5. Make the experience coherent
AI can produce many screens quickly, but those screens need a shared language. Review terminology, navigation, loading states and error messages. People should understand what happened and what they can do next.
Pay particular attention to first use. Can a new person achieve something useful without understanding the technology behind it? If every action needs your explanation, the product needs another pass. Experienced product judgement can make a substantial difference without rebuilding the entire app.
Common questions
Does a vibe-coded app need to be rewritten?
Not necessarily. Start by reviewing structure, data, security and the most important user journeys. Some parts can stay, some need improvement and others may need a different approach. A complete rewrite should have a clear justification.
When should I involve an experienced developer?
Before the app handles important personal information, takes payments or becomes critical to someone’s work. Get help when you can no longer explain failures or judge the consequences of changes proposed by AI.