Konstantin Tikhaev

Previously worked as a warehouse supervisor, and I created my first functional app three weeks ago using the AI programming helper. It is a simple app that scans delivery slots at a local bakery and it took me eleven nights.

This is what I have learned. The helper is willing to create the wrong thing very quickly, and I have written a one-paragraph description of what the bakery owner actually does every morning before entering any request to the helper.

Every time I use Cursor to build something, I have a simple text document with all my prompts that worked well. The first month, everything was a mess, and the prompts had names like fix thing or better version.

Right now, each one has a name telling me what I created thanks to it, such as Stripe webhook with retry logic or empty state for the dashboard. It may not seem like a big deal, but I found it made me reuse them much more frequently.

AI can get me to a working app in a day, but "it works on my machine" and "it's safe for real users" are very different things.

The part that worries me is the boring stuff that's easy to miss when the code looks clean and everything runs: API keys sitting in the frontend, auth checks that exist on the page but not on the endpoint, database rules left wide open from the prototype stage, no rate limits on anything. The AI rarely warns you about these unless you ask, and by the time you think to ask, you've already moved on to the next feature.

Right now my pre-launch process is mostly manual and a bit random: I skim through the auth flow, search the repo for hardcoded secrets, and try to break things as a logged-out user. It catches some things, but I never feel fully confident.

I'd love to hear how others handle it: