Harden or rebuild your AI-built app?
Harden the app you have if its gaps are isolated, such as missing auth checks on some routes, no logging, or no tests. Consider starting fresh when the gaps sit in the foundations: how users and permissions work, how data is modeled, or how the app is deployed.
A free scan of your repo shows which situation you are in, so you decide on evidence instead of a feeling.
The free scan this guide points to works on JavaScript and TypeScript projects. On another stack, use the production readiness checklist and check each item by hand.
How to decide
Scan the repo
Get the list of failed checks for your actual code. Astro Score runs 22 checks covering security, testing, observability and more.
Sort each gap: add-on or foundational
An add-on gap can be fixed without changing how the rest of the app works: a timeout, a log line, a test, an auth check on a route. A foundational gap changes how everything else works: who users are and what they can do, how data is stored, how the app is deployed.
Look at what the app has to carry next
If the next year is more of the same product, an app with add-on gaps is worth hardening. If it needs accounts with roles, billing, multiple languages or a mobile app, and none of that exists yet, count those as foundational gaps too.
Decide
Mostly add-on gaps: harden. Several foundational gaps: starting fresh is often cheaper and faster, and the prototype still has value as a working spec of what to build.
Most gaps are the add-on kind
In Astro's scan of 53,588 scored AI-generated repositories, the most common gaps were things you add rather than redesign: 93% had no logging, 91% had no timeouts on external HTTP calls, 85% had no error boundaries and 60% had no tests. Missing API auth guards (86%) can go either way: adding checks to a clean set of routes is hardening; untangling auth that was improvised differently on every screen is foundational.
The production readiness checklist covers how to close each of these in an existing app.
Where Astro fits, honestly
If you harden, you or your team do the work, guided by the scan report and the checklist. Astro does not take over, fix or migrate existing apps today. Bringing an existing app into Astro comes in a later phase.
If you start fresh, that is what Astro is for in its first version. New projects start on the Foundation, which already has auth with MFA and social login, role-based access control, Stripe billing, internationalization, and web and mobile from one codebase. You keep your own coding agent, and nothing reaches production without your approval. Astro is in preview; join the waitlist if that is the path you choose.
Common questions
- Can I fix an AI-built app myself?
- Often, yes. Gaps like missing API auth guards, logging, timeouts and tests can be added to an existing codebase by you or your team, one at a time.
- When is rebuilding worth it?
- When the gaps are in the foundations: auth and permissions patched in differently on every screen, a data model that fights your product, or no way to run separate staging and production. Fixing those in place often costs more than starting fresh.
- Does Astro fix or migrate existing apps?
- Not today. Astro's first version is for new projects, which start on its production-ready Foundation. Bringing an existing app into Astro comes in a later phase. For an existing app, the free scan is the way to see where you stand.
About this data
In April 2026, Astro scanned 103,653 public GitHub repositories with strong signals of being AI-generated. 53,588 of them had enough JavaScript or TypeScript code to be scored, and every percentage on this page is a share of those 53,588. Each repository went through the same 22 automated checks that Astro Score runs.
The checks read the code; they do not run the app. A check passes when the safeguard is present in the code, which is not the same as proving it works. Public repositories are not a random sample of every app in production, so treat the numbers as a strong pattern rather than a census.