Pre-launch audit for AI-built software

Vibe-coded is not ship-ready.

Artificial Intelligence can write a working app in an afternoon. It can't take responsibility for it. Before your product reaches users, app stores or regulators, someone has to audit it and refine it.

See the eight areas Run the checklist
  • Security
  • Usability
  • Store review
  • Compliance
  • Accessibility
  • Privacy
  • Performance
  • Maintainability

Why now

Code is cheap now. Mistakes still cost what they always did.

Vibe coding, coding agents and automated pipelines have made producing software almost free. The demo works, the screens look right and the happy path runs. But AI models are tuned to make code that runs, not code that is safe, lawful, accessible and maintainable. Those qualities aren't in the prompt, so they aren't in the output.

The gap shows up later: a leaked API key, an app rejected at review, a regulator's letter, a customer who can't use your checkout with a screen reader. Each one costs far more after launch than before it. Auditing isn't there to slow you down. It's what turns a fast prototype into a product you can stand behind.

The eight areas

Where AI-built software breaks, and what to check

The first four decide whether you're allowed to launch at all. The other four decide whether the product survives once it's live.

Gatekeepers Whether you can launch

01

Security

Generated code often copies insecure patterns, puts secrets in client bundles and skips authorisation checks it was never asked to write.

  • No API keys or credentials in the repo, the front end or the logs
  • Authentication and authorisation on every endpoint and database row
  • Input validation, rate limiting and safe error messages
  • Every dependency is real, maintained and audited, with no hallucinated packages
  • LLM features tested against prompt injection

At stake: breaches, ransom, loss of trust overnight.

02

Usability

AI builds the happy path it was asked for. Real users hit the empty states, errors, slow networks and odd inputs nobody prompted for.

  • Empty, loading, error and success states exist for every screen
  • Consistent navigation, labels and patterns throughout
  • Forms say what went wrong and how to fix it
  • Watched sessions with five real users on the key journeys

At stake: churn, one-star reviews, support costs.

03

App store acceptance

Apple and Google review every release. An app that crashes, shows placeholder content or mishandles data is rejected before anyone sees it.

  • No crashes, broken links or placeholder text (Apple guideline 2.1)
  • A privacy policy, accurate Privacy Nutrition Labels and Data safety form
  • In-app account deletion wherever account creation is offered
  • Targets Google Play's current minimum API level
  • New personal Play accounts: closed test with 12+ testers for 14 days

At stake: rejection, removal, a suspended developer account.

04

Compliance

Regulators don't care who wrote the code. GDPR, POPIA, PCI DSS and the EU AI Act all apply to what your product does, including automated decisions.

  • Map which laws apply: where your users live and what data you handle
  • Lawful basis and consent records for every type of processing
  • Credit card data handled only by a PCI DSS compliant provider
  • AI features assessed against the EU AI Act's risk tiers
  • Terms, disclosures and audit trails in place before launch

At stake: fines, injunctions, the business shut down.

Four more Whether it survives after launch

05

Accessibility

Generated UIs often skip labels, use low contrast and only work with a mouse. That shuts out disabled users, and in many markets it's now illegal.

  • WCAG 2.2 AA contrast, focus order and visible focus
  • Every control works with keyboard and screen reader
  • Alt text, form labels and real semantic elements
  • EU Accessibility Act in force since 28 June 2025

At stake: lawsuits, lost customers, procurement bans.

06

Privacy and data protection

AI-built apps collect too much, keep it forever and quietly send it to third-party APIs, including the AI models inside the product.

  • Collect only what each feature needs
  • A retention period and a deletion path for every data type
  • No personal data in logs, analytics or prompts to external models
  • Contracts and transfer safeguards for every processor

At stake: data subject complaints, regulator audits, reputational damage.

07

Performance and reliability

A demo with ten rows is fast. Ten thousand users expose the N+1 queries, missing indexes, absent backups and the lack of monitoring.

  • Core Web Vitals: LCP ≤ 2.5 s, INP ≤ 200 ms, CLS ≤ 0.1
  • Load tested at several times expected peak traffic
  • Error monitoring, alerts and uptime checks live from day one
  • Automated backups with a restore you have actually tested

At stake: outages at launch, lost revenue, data loss.

08

Maintainability and licensing

Code nobody on the team understands can't be safely changed. Generated snippets can also bring in copyleft licences that put your IP at risk.

  • Someone on the team can explain every critical module
  • Automated tests on core logic, run in CI on every change
  • A software bill of materials with every licence reviewed
  • Architecture, setup and runbooks written down

At stake: stalled roadmap, IP disputes, a failed due diligence.

Self-assessment

The pre-launch audit checklist

Tick only what you have verified, not what you believe. Your progress stays in this browser only.

Not ready to ship 0 / 16 verified
01 Security
02 Usability
03 App store acceptance
04 Compliance
05 Accessibility
06 Privacy and data protection
07 Performance and reliability
08 Maintainability and licensing

How to do it

Audit, refine, verify, ship, watch

  1. 1

    Audit

    Review the generated code against all eight areas: automated scanners first, then human review where the risk is highest.

  2. 2

    Refine

    Fix the findings at the root. Remove what nobody understands, harden what's left, and write down the decisions.

  3. 3

    Verify

    Re-test on real devices, in every browser and with real users. Store pre-review checks and a compliance sign-off come last.

  4. 4

    Ship

    Release in stages, with feature flags and a tested rollback, so a surprise affects a few users and not all of them.

  5. 5

    Watch

    Monitor errors, performance and new regulations. Re-audit on every major AI-assisted change, not once a year.

Documentation pack

Software that explains itself, to everyone who has to trust it

AI-built systems usually arrive with no documentation at all. We document the system you actually have: what it does, how it's built, how to deploy it, how to change it safely and where it stands on compliance. Six documents, each written for the person who will read it.

01

Executive summary

For: owners, boards, investors and buyers

  • What the system does, who uses it and what it's worth to the business
  • Its condition in plain language, with a red / amber / green risk rating
  • Running costs, key dependencies and single points of failure
  • The top recommendations, ranked by risk and cost
02

Functional specification

For: product owners, testers and support

  • Every user role, screen and journey, as built rather than as hoped
  • Business rules, validation and what happens when things go wrong
  • Emails, notifications, reports and integrations users see
  • Acceptance criteria you can test a future change against
03

Technical specification

For: architects and engineers

  • Architecture diagram, stack and exact versions
  • Data model, APIs, third-party services and where data flows
  • Authentication, authorisation and how secrets are handled
  • Hosting, scaling limits and performance measurements
04

Deployment and operations runbook

For: whoever deploys and runs it

  • Environments and configuration, with secret names but never their values
  • Step-by-step deploy and a rollback that has actually been tested
  • Backups, a restore that has been rehearsed, and monitoring
  • What to do when it breaks at 2 a.m.
05

Developer handover guide

For: the next team to change the code

  • A working local set-up in an afternoon, not a week
  • A map of the code, its conventions and why key decisions were made
  • How to run the tests and make a change without breaking anything
  • Known technical debt, written down rather than discovered
06

Compliance and risk report

For: legal, auditors, insurers and buyers

  • Security test results and how each finding was fixed
  • A personal-data map for POPIA and GDPR: what is held, where and why
  • Accessibility results against WCAG 2.2 AA
  • Open-source licence inventory and code ownership
  • PCI DSS scope for any credit card payments, and app store policy status

Selling the system, or buying one?

A buyer's first fear is paying for a problem: code nobody understands, a data breach waiting to happen, licences that aren't yours to sell, or a system that only its original author can run. The pack answers those questions before they're asked, with evidence rather than assurances.

  • Who owns the code, and which licences come with it
  • Where personal data goes, and how it is protected
  • What has been tested, and what the results were
  • What it costs to run, and who else could maintain it

Ready for due diligence, a handover or your next release.

Ask for a documentation pack

Ship fast. Ship refined.

Speed is a gift from Artificial Intelligence. Responsibility is still yours. Run the audit before your users, the app stores or a regulator do it for you.

Start the checklist Talk to Terminal Velocity AI

Get in touch

Want a second pair of eyes before launch?

Tell us what you're shipping and where you're worried. Terminal Velocity AI audits and refines software built with Artificial Intelligence, covering security, usability, store acceptance and compliance.

Send a message

Your message is emailed straight to us and not stored on this site. Fields marked * are required.