AI builders like Lovable, Bolt, Replit and v0 are genuinely impressive. You describe what you want, and an hour later there's a working app on your screen. Then you try to launch it, and things get less obvious. The preview link isn't a business. Here's what usually stands between the two.
1. A proper address
Your app needs its own domain, not the builder's preview link. Most builders let you connect one on a paid plan, but you'll still need to buy the domain and set up the DNS records that point it at your app. While you're there, set up email on the same domain so your messages don't look like they came from a stranger.
2. Secrets kept secret
This is the big one. AI-generated code sometimes puts private keys (for your database, payment provider or email service) where anyone can read them in the browser. Anything with "secret" in its name must only ever live on the server. If you've ever pasted a key into a prompt, assume it's in the code somewhere and check.
3. Database access rules
Many AI-built apps use Supabase or a similar database that's reachable straight from the browser. That's fine, as long as access rules are switched on and actually written. Without them, anyone who finds your app's address can often read or change everyone's data. Security researchers have found plenty of AI-built apps in exactly this state.
4. Logins that hold up
Check what happens when someone signs up twice, resets a password, or tries to open another user's page by changing the address. These are the places generated code tends to cut corners.
5. Payments in live mode
Test payments are one thing. Live payments need live keys stored safely, webhooks so your app knows when someone has actually paid, and a plan for refunds and failed cards.
6. The legal bits UK businesses need
- a privacy policy that says what data you collect and why
- a cookie banner that asks before setting analytics or marketing cookies (UK GDPR and PECR)
- terms of use, and terms of sale if you're charging
The ICO's guidance for organisations is a good place to start.
7. Being findable
AI builders often produce apps that load their content with JavaScript, which search engines and link previews can struggle with. Check that each page has a real title and description, that there's a sitemap, and that sharing a link on WhatsApp shows something sensible.
8. Knowing when it breaks
Set up basic analytics, error alerts and backups before launch, not after the first customer emails to say it's broken.
When to get help
If you've read this list and ticked everything, brilliant. If some of it made your stomach drop slightly, that's normal, and it's fixable. I help people take what they've built with AI and get it live properly: domain, hosting, a security check, payments and the legal pages. I'll look at what you've made first and tell you plainly what it needs. Get in touch and tell me what you've built.
This article is general information, not legal, tax or financial advice. Rules change, so check the official guidance for your own situation.
