AI can build you a working application in an afternoon. Whether it's safe to run is a different question entirely.
We've just finished building our own operations platform. It pulls live data from five separate systems, service desk, monitoring, backup estate, firewall management and hosting infrastructure, into one dashboard. It runs on our own infrastructure, checks every connected system every five minutes, and hasn't needed intervention since the day it went live.
It's fast, it's genuinely useful, and we built it quickly with AI assistance.
The part people get wrong is assuming that last sentence is the interesting one.
The AI Wrote the Code. It Didn't Make the Decisions.
AI wrote a lot of this platform. What it couldn't do was make the handful of choices that decide whether a system is safe to run.
Least Privilege, by Default
Most platforms offer you the highest permission level first when you create an API user. One click, works immediately, no warnings. The software equivalent of handing over the master key because it saves you finding the right one.
In our backup platform, the default role could retrieve encryption passphrases, the keys that decrypt every protected system. A status dashboard has no business holding those.
We picked the lowest role that worked and left the box unticked. The application never noticed. Our clients would have if that credential had ever leaked.
Credentials Stay Out of the Codebase
Every API key lives in an environment file, permissions locked to the owner, sensitive files excluded from version control.
Not one key, token or database credential sits in our repository. A five minute decision that heads off one of the most common failures in AI-assisted projects: secrets committed to source control where they remain long after they've been rotated and forgotten.
Containment
The application runs as a non-privileged user in its own container, on its own network, with defined CPU and memory limits.
If it misbehaves it can't reach anything else on the machine or starve it of resources. One decision made at the start that keeps paying dividends for the life of the application.
Access That Means Something
Three administrators. One read-only account that can comment but not change configuration. Role-based controls on every settings page.
Reset a password or disable an account and every active session dies immediately rather than remaining valid until a cookie eventually expires.
It Tells You When It's Broken
Every screen carries a live heartbeat indicator, so the moment a connected system stops responding the status goes red, even if the dashboard itself is running perfectly.
That's the failure that catches people. The pages still load. The numbers still display. The information quietly goes stale while decisions continue to be made on it.
A Way Back
Before migrating we took backups, verified them, and kept the old environment intact rather than deleting it.
Nightly database backups have run ever since. Optimism is not a rollback plan.
What Happens Without That Knowledge
This is where vibe coding turns from useful to expensive.
AI will confidently hardcode your API keys, request every permission on the menu, and produce an architecture nobody can maintain in six months, including the AI that wrote it.
It will build you a dashboard that displays numbers with total conviction and no way of knowing whether they're right. It will not mention any of this. It will tell you the code looks great.
None of it shows up in a demo. It shows up in an audit. Or after a breach. Or on the morning something breaks and nobody knows where to start.
The failure mode that catches most people isn't a crash. It's a system that keeps running while being quietly wrong.
Getting the Benefit Without the Exposure
We're not arguing against AI-assisted development. We've just built a serious platform with it, faster than we could have otherwise.
The value is in combining AI speed with engineering experience. Someone still has to understand the code, the architecture, the security model and the operational risks.
Without that, you're not moving faster. You're accumulating risk you can't see and won't be able to fix when it matters.
If you've built something with AI and you're not certain it's secure, have someone qualified look at it.
We'll assess:
- How credentials are stored and protected
- What permissions your integrations actually have
- Whether your architecture is maintainable and scalable
- What happens when a component fails
- Your backup and recovery capability
- Security risks, operational risks and technical debt
You'll get a clear, practical report: what's wrong, what the risks are, and what to fix first.
A straight answer about whether what you've built is safe to keep running.