How to make an AI-built app production ready
To make an AI-built app production ready, close the ten gaps AI tools most often leave open: API auth guards, secrets and environment separation, timeouts on external calls, error boundaries, logging, tests, CI/CD, a staging environment, monitoring, and a human approval step before production.
Work through them roughly in that order, because the first items protect users and data and the last ones protect every future release. A free scan of your repo shows which ones you already have.
The free scan this guide points to works on JavaScript and TypeScript projects. On another stack, use the production readiness checklist and check each item by hand.
The checklist
Auth on every API route, not just the login screen
Every route that reads or changes data checks who is calling and whether they are allowed to. A login page does not help if the API behind it answers anyone who knows the URL.
Check: call an API route without a session. It should refuse. In Astro's scan, 86% of scored repositories were missing API auth guards.
Secrets out of the code, environments separated
API keys and database credentials come from environment variables, never from the repo. Development, staging and production each use their own values. An example env file lists what is needed without real values. If a key was ever committed, rotate it.
75% of scored repositories had hardcoded secrets or no environment separation.
Timeouts on every external call
Calls to payment providers, AI models and other APIs have a timeout and a clear failure path (retry, fallback or a useful error). Without one, a slow vendor makes your whole app hang.
91% of scored repositories had no timeouts on external HTTP calls.
Error boundaries in the interface
When one part of the screen fails, the user sees a message and can keep going, instead of a blank page.
85% of scored repositories had no error boundaries.
Logging and observability
Errors and key events are recorded somewhere you can search, with enough context (which user, which request) to reproduce the problem.
93% of scored repositories had no logging or observability.
Tests on the paths that matter
You do not need full coverage on day one. Start with sign up, sign in, payment, and the one action your product exists for.
60% of scored repositories had no tests.
CI/CD
Every change runs lint, type checks and tests automatically before it merges, and deploys come from the pipeline rather than from someone's laptop.
64% of scored repositories had no CI/CD.
A staging environment
A separate copy of the app, with its own data and keys, where every change lands before production. It is the place to catch a broken migration or a missing env variable without users seeing it.
Monitoring and alerts
Uptime checks and error alerts that reach a person. Logging tells you what happened; monitoring tells you that something is happening right now.
A human approval step before production
Someone who understands the product reviews what is changing and approves each release to production. AI agents can write and ship code quickly; this step keeps a bad change from reaching users unnoticed.
How to use this checklist
Start with a scan so you know where you stand. Astro Score checks your repo for most of the items above and tells you what is missing. Fix the items that expose data or money first (1 and 2), then the ones that handle and reveal failures (3 to 5), then the ones that make change safe (6 to 10).
If the list of gaps is long and they touch the foundations of the app, read Harden or rebuild your AI-built app? before you start fixing. For the full numbers behind each item, see What breaks when AI-generated apps go to production.
Common questions
- What does production ready mean for an AI-built app?
- It means the app protects user data, tells you when it fails, survives slow or failing outside services, and can be changed safely. In practice, that is the ten items on this checklist.
- Which item matters most?
- API auth guards and secrets, because those failures expose user data or cost money. Logging comes next, because without it you cannot see any other failure.
- How do I check my app against this list?
- Run a free Astro Score scan on the repo. It runs 22 checks covering security, testing, observability and more, for JavaScript and TypeScript projects.
About this data
In April 2026, Astro scanned 103,653 public GitHub repositories with strong signals of being AI-generated. 53,588 of them had enough JavaScript or TypeScript code to be scored, and every percentage on this page is a share of those 53,588. Each repository went through the same 22 automated checks that Astro Score runs.
The checks read the code; they do not run the app. A check passes when the safeguard is present in the code, which is not the same as proving it works. Public repositories are not a random sample of every app in production, so treat the numbers as a strong pattern rather than a census.