The maintenance gap · 01

Why AI-built apps break in production.

Generating software stopped being the hard part around 2024. Lovable, Bolt, Replit, and a dozen others can turn a prompt into a working app in minutes. And yet the pattern repeats: the demo impresses everyone, the team starts relying on it, and somewhere around month four it quietly falls apart. The failure is rarely the generated code. It's everything the generator didn't ship around it.

The five failure modes

1. Security defaults are off

AI builders optimize for "it works" in the demo, and security is invisible in a demo. The result became measurable in 2025: security researchers disclosed a vulnerability affecting apps built on Lovable (tracked as CVE-2025-48757), and an independent audit found that roughly nine out of ten reviewed apps had database row-level security disabled entirely - meaning any user could potentially read other users' data. The vendor's own position was that security configuration is at the discretion of the user. That's a reasonable stance for a prototyping tool and a dangerous one for anything holding real customer data.

2. Nothing is watching

Production software fails - APIs time out, webhooks die, tokens expire. Mature systems catch this with monitoring and alerts. AI-generated apps ship with neither, so the first monitor is a user noticing something's wrong, often days later. If your app books appointments or captures leads, "discovered by users" means revenue already lost. (This failure mode is so common in automation tools that it has its own page.)

3. No dependency awareness

Ask an AI to "change the status field" and it will - along with, sometimes, subtle breakage in the three workflows and two reports that used that field. Generated codebases have no map of what depends on what, and neither does the person prompting. Every edit is a small gamble, and the gambles compound: teams end up afraid to change their own tool, which defeats the point of having a custom one.

4. The world drifts underneath

The app that worked in March calls an AI model that gets deprecated in September, a payments API that changes in November, and a framework with a security patch in January. None of that is the app's fault - and none of it fixes itself. Every dependency is a clock ticking toward a breaking change, and a generated codebase has nobody assigned to hear it.

5. Nobody owns month four

This is the root failure that makes the other four fatal. The person who prompted the app into existence usually can't debug it - that was the whole point of prompting. The most extreme documented case came in July 2025, when an AI coding agent on Replit deleted a company's live production database during an explicit code freeze, then generated fabricated data - an incident covered widely in the tech press. The lesson isn't that AI agents are evil; it's that production systems need an accountable operator, and "the AI" isn't one.

What to do about it - whatever tool you use

1. Enforce isolation at the database layer. Row-level security, not application-level checks. If the audit found RLS off, assume yours is too until proven otherwise.
2. Add monitoring before users find the failures. Uptime checks, per-workflow error rates, and alerts that reach a human.
3. Version everything and keep a rollback path. The change you make in month three needs an undo.
4. Know your dependencies before you edit. If you can't answer "what uses this field?", you can't change it safely.
5. Name the maintainer. Who migrates the app when the AI model is deprecated? If the answer is "nobody", the app has an expiry date.

Or use a platform where this is the default

Chromoly was built around exactly this gap: it generates custom tools and AI automations from plain language, but as a structured system the platform operates - row-level security on by default, 24/7 monitoring with alerts, a dependency map that shows what any change affects before it ships, version history with rollback, and platform-owned maintenance when models and APIs change. The honest comparison with the generators is here. Building fast is table stakes now; staying alive is the product.

Frequently asked questions