You built something that works. It took a weekend, a handful of clever prompts and an AI tool that felt like magic. Your team is using it, and perhaps your customers are next.
Here is the question that rarely gets asked at that point: would it survive a proper inspection?
We recently audited a self-built app for a business owner who was rightly proud of it. It did exactly what he wanted. The audit graded it between a D+ and a C-, mainly because of security issues. Nothing looked broken, and that is precisely the problem.
Why Working Software Is Not the Same as Safe Software
AI building tools are brilliant at making something run. They are far less likely to stop and ask who should be allowed to see what, what happens if someone skips the login screen, or where your data actually lives. A prototype can pass every click-through test and still leave several doors unlocked.
That grade was not a verdict on the owner’s effort. It measured the gap between a prototype and something you can trust with real customers, real data and your reputation. For most business owners, reliability is the quiet worry underneath every AI project: it works today, but will it still work, and stay safe, when it matters?
Think of a shop fitted out over a weekend. The shelves look lovely and the till works, but nobody has checked the back door, the alarm or who holds the keys. That is fine for a test run. It is far riskier once the public walks in.
The Flaws You Will Never Find by Clicking Around
When one of our retainer customers read through an audit report on their own platform, one line stopped her. She wanted to understand the findings, and put it plainly:
“Several serious security issues, including in sign-in, in what one organisation can see another’s data.”
Her instinct was right to focus there. If your software serves more than one client or department, the nightmare scenario is one account seeing another’s information. Everyday use will never reveal it, because everyday users do not go looking. Whoever is looking for it will find it very quickly.
This is also where trust is won or lost. Customers rarely ask how your software was built. They ask whether their data is safe with you, and you need a better answer than “it seems fine”.
A fair question follows: how would you know? Usually you would not, until a customer, an auditor or someone less friendly pointed it out. Finding it first, on your own terms, is considerably cheaper and calmer.
Why Previous Security Checks Can Miss It
Here is the part that surprises people. The same customer had commissioned penetration tests in the past, and those rarely turned up anything to address. Yet the code audit found an issue that, in our words to them, had always been in the code. It only surfaced once we began reviewing the logic from the inside as part of their retainer.
“It’s always been in the code, but it’s only since we’ve started the code audits and a different way of looking at things that we’ve discovered it.”
The two approaches ask different questions. A penetration test probes your system from the outside, like a burglar trying the windows. A code audit reads the plans, and spots the door that was never fitted with a lock. Both are valuable. Relying on only one gives you a false sense of comfort.
Four Questions to Ask About Any AI-Built App
You do not need to be technical to start. Ask whoever built it, or the AI tool itself, these four things. First, who can see which data, and how is that enforced? Second, how does sign-in work, and what happens when it fails? Third, where is the data stored, and who controls it? Fourth, what happens when something breaks at two in the morning?
If the answers are vague, that is useful information. It does not mean starting again. Most apps with a poor first grade need targeted fixes in the right order, not a rebuild. The aim is to move from “it works” to “it works, and we can prove it is safe”.
Speed is the appeal of AI tools, and it should stay that way. A short, structured review simply makes sure the speed you gained is not quietly borrowed against your customers’ trust later.
Not Sure Where Your App Stands?
If you have built something with AI and you are wondering how it would score, we would be glad to take a look. Our free 45-minute Operational Audit gives you an honest view of where your tools are solid, where the risks sit and what to fix first, with no obligation and no jargon.
Book yours at greengorillaautomation.co.uk.
