Working Is Not the Same as Safe

A founder asked me to look over his app "just to be safe." He'd built a venue-booking marketplace on Replit without writing the code himself, venues were listing, customers were booking, and I could tell from his voice he expected me to say it looked fine.

It mostly did. I went through the codebase and came back with 49 items, and most of them were the ordinary things you'd expect in any first version. Two were not.

The first was the secret key that signs login tokens, sitting in the code repository in plain text. Anyone who could read the code could mint themselves an admin account. The second was in the flow where a venue connects its Stripe account to receive payouts. That handshake never checked who started it, so someone could attach their own bank account to another venue's earnings. Neither flaw was visible from the outside. Every page loaded, every booking went through, and the app would have kept working right up until somebody with bad intentions noticed.

None of this was his fault. The AI wrote code that ran, and he had no way to evaluate what it had skipped. That is the position every founder building on Replit, Lovable, or Bolt is in right now.

I didn't rebuild anything. I wrote him prompts he could paste straight into his AI tool, one per fix, and he shipped both himself that week. He still owns his codebase. He just knows what's in it now.

If your AI-built product has paying customers, has anyone who knows what to look for actually read the code they're trusting?

#FractionalCTO #StartupFounder #BootstrappedStartup #StartupTech