04
Shipping the demo

Websites and web apps

Building software with AI feels like the cheat code it was promised to be, right up to the moment the thing has real users, real data and a real bill. This chapter is written from the wreckage: the patterns that turn a working prototype on Tuesday into an unmaintainable, insecure, unfinishable product by Friday.

17 ways to get it wrong

make me an app like airbnb but for dogs, and make it beautiful
Prompt one of a project that will have forty-one prompts and no launch
  1. 4.1

    Ask for the whole product in the first message.

    WhyAuth, payments, dashboard, admin panel and marketing site in one request means every part gets a sketch and nothing gets a foundation. You cannot review what you cannot read.

    ResultA build you never fully understand. From there every fix is a guess, because you are debugging a stranger's codebase that happens to be yours.

  2. 4.2

    Skip the data model. Start with the pretty page.

    WhyThe shape of your data decides what the app can ever do. Design it after the screens and you will be bending screens around accidents for the rest of the project.

    ResultA rewrite in week three, usually the week you promised the client a demo.

  3. 4.3

    Say 'make it modern and clean' and let the model decide.

    WhyThat phrase has one meaning in the training data: the same centred hero, the same three cards, the same purple gradient, the same rounded corners.

    ResultA site indistinguishable from ten thousand others. Visitors cannot tell you apart, so they price you as a commodity.

  4. 4.4

    Hardcode colours everywhere instead of using tokens.

    WhyFifty components each holding their own hex value means a rebrand is fifty edits, and dark mode is impossible without touching every file.

    ResultA one-hour design change becomes a two-day sweep, and something always gets missed on a page nobody looks at.

  5. 4.5

    Ignore mobile until launch day.

    WhyMost of your traffic is on a phone. Layouts built desktop-first do not shrink gracefully, they collapse.

    ResultHalf your visitors meet a broken page. They do not report it, they leave.

  6. 4.6

    Put the API key in the frontend because it works.

    WhyAnything shipped to the browser is public. Working and safe are different tests, and only one of them shows up in the preview.

    ResultA drained account, a rotated key, and an incident email you write on a Saturday.

  7. 4.7

    Turn off the database security rules to fix the bug faster.

    WhyAccess rules are the whole defence between a user and everyone else's rows. Disabling them removes the error message, not the problem.

    ResultEvery customer record readable by anyone who opens the network tab. This is the failure that ends companies, not sprints.

  8. 4.8

    Trust the client to decide who is an admin.

    WhyA role kept in local storage or a hidden field is a suggestion, not a permission. The browser belongs to the visitor.

    ResultPrivilege escalation by anyone curious enough to open dev tools for ninety seconds.

  9. 4.9

    Never open the app yourself. Judge it from the screenshot.

    WhyScreenshots hide empty states, slow loads, failed requests, keyboard traps and the button that does nothing on tap.

    ResultBugs discovered by users. Each one costs more trust than ten features earn.

  10. 4.10

    Report bugs as 'it does not work'.

    WhyNo route, no steps, no console error, no expected result. The model then fixes the most likely thing, which is rarely your thing.

    ResultThree rounds of changes to unrelated files. The bug survives, and now there are two more.

  11. 4.11

    When something breaks, ask for a rewrite instead of a diagnosis.

    WhyRewrites discard the parts that already worked, including the ones you never tested but were quietly holding the app together.

    ResultA new codebase with a new set of unknown bugs, and the original one probably still in there.

  12. 4.12

    Keep adding features on top of a broken foundation.

    WhyEvery feature built on a wrong assumption multiplies the cost of correcting that assumption later.

    ResultThe project reaches the point where fixing it costs more than starting again, which is the point most AI-built apps die at.

  13. 4.13

    Never write down what the app is supposed to do.

    WhyWithout a written spec, the definition of finished drifts every session, for you and for the model.

    ResultA permanent ninety percent. It is nearly done for four months.

  14. 4.14

    Ship with placeholder text, lorem ipsum and stock smiles.

    WhyCopy is the product for a visitor. Placeholder content signals that nobody senior has looked at this page.

    ResultBounce. People decide in seconds whether a site is a real business.

  15. 4.15

    Skip loading states, empty states and error states.

    WhyThe happy path is the rarest path in production. Real apps are mostly waiting, nothing yet, and something went wrong.

    ResultA blank white screen that users read as broken, then a support ticket that says the same.

  16. 4.16

    Leave the page title as the default and forget the meta description.

    WhyThat title is your entire pitch in search results, in browser tabs and in every link anyone ever shares.

    ResultZero organic traffic and shared links that look like an unfinished template, because they are.

  17. 4.17

    Launch without ever testing what a signed-out visitor sees.

    WhyYou are always logged in. Your whole experience of the app is the one experience almost no first-time visitor has.

    ResultNew users hit a redirect loop or an empty dashboard, and you never find out because you cannot reproduce it.

Grading your failure

Three levels. Anyone can reach bronze on a Monday morning.

Bronze

It looks like a template because it is one.

Silver

The app works only on your machine, while you are logged in.

Gold

A stranger reads your customer table and tells you about it politely.

Next chapter 05AI avatars and voice