I built a prototype with AI. What now?
Before real users arrive, find out what will break in production. AI tools are good at getting a prototype to work, and they routinely skip the parts that keep an app running: logging, API auth guards, timeouts and tests.
Scan the repo, fix the gaps that put users or data at risk, then decide whether to harden what you have or start fresh.
The free scan this guide points to works on JavaScript and TypeScript projects. On another stack, use the production readiness checklist and check each item by hand.
What to do next, in order
Write down what real users will do with it
Note who signs in, what data the app stores, and whether money changes hands. That short list decides which gaps are urgent. An internal tool for five colleagues and a paid app for strangers need different levels of care.
Scan the repo instead of guessing
AI tools build what you ask for. Nobody asks for timeouts or audit logs in a demo, so those are the parts that go missing. A scan gives you a concrete list of gaps. Astro Score runs 22 checks covering security, testing, observability and more.
Close the gaps that expose data or money
Check that every API route verifies who is calling, that secrets live in environment variables rather than in the code, and that calls to outside services have timeouts. In Astro's scan, 86% of scored repositories were missing API auth guards, 75% had hardcoded secrets or no environment separation, and 91% had no timeouts on external HTTP calls.
Make failures visible
Add logging and error tracking before launch, not after the first complaint. Without it, you learn about a broken signup from a user, if at all. 93% of scored repositories had no logging or observability.
Put a safety net around changes
Add tests for the flows that matter (sign up, sign in, payment, the core action), a CI pipeline that runs them on every change, and a staging environment where changes land first. 60% of scored repositories had no tests and 64% had no CI/CD.
Decide whether to harden or start fresh
If the gaps are isolated, harden what you have. If they sit in the foundations, starting fresh can be cheaper. The guide Harden or rebuild your AI-built app? walks through the decision.
Ship with a human approval step
Before anything reaches production, a person who understands the product reviews what changed and approves it. AI agents can write and deploy code quickly; the approval step is what stops a bad change from reaching users unnoticed.
Why the prototype is not the product yet
A prototype proves the idea works when everything goes right. Production is everything going wrong at once: a vendor is slow, a user sends unexpected input, someone calls your API directly. When Astro scanned 103,653 public GitHub repositories that look AI-generated, only 1% of the 53,588 that could be scored reached the production ready band (86 to 100). 83% scored 0 to 65, which means critical or significant gaps.
That is not a reason to throw the prototype away. It is a reason to know exactly what is missing before you put real people on it. The production readiness checklist covers each gap in detail.
Common questions
- Is an AI-built prototype good enough to launch?
- It is usually good enough to show people. It is rarely ready for real users, real data or payments without more work. In Astro's scan of 53,588 AI-generated repositories, only 1% scored as production ready.
- What should I fix first?
- Anything that can expose data or money: API routes without auth checks, secrets written into the code, and no separation between development and production settings. Then add logging so you can see failures.
- Do I have to rewrite it?
- Not usually. If the gaps are isolated, you can harden the app you have. Starting fresh makes sense when the gaps sit in the foundations, such as auth, the data model or deployment. A scan shows which case you are in.
About this data
In April 2026, Astro scanned 103,653 public GitHub repositories with strong signals of being AI-generated. 53,588 of them had enough JavaScript or TypeScript code to be scored, and every percentage on this page is a share of those 53,588. Each repository went through the same 22 automated checks that Astro Score runs.
The checks read the code; they do not run the app. A check passes when the safeguard is present in the code, which is not the same as proving it works. Public repositories are not a random sample of every app in production, so treat the numbers as a strong pattern rather than a census.