A third AI model audits the code before launch: 100 bugs found in a no-code founder's SaaS

Founders who cannot read code ship AI-written apps that look finished but break in the places where money and data cross between files: checkout webhooks, credit spending and database access rules.

1. Split the AI work into roles: one model writes features (here React, Supabase and edge functions), one handles design and infrastructure, and a third only audits what the other two ship. The founder acts as product manager and tester. 2. Before letting anyone pay, point the auditor at the whole codebase and ask for bugs and code-quality issues. 3. Fix the dangerous findings first. In this case: two products mapped to one payment price ID so buyers got the wrong credits; credit spending done in the browser so anyone could call the paid API directly; database tables holding the core data readable with the public key; and a feature whose handler was never exported, so it silently did nothing. 4. Move money and access rules to the database (a unique index for webhook idempotency, a server-side function that deducts credits, locked read policies) and add a CI check that every edge function exports its handler. 5. Write an 'invariants' document of cross-file rules (for example, every paid checkout ends with credits on the right account; no public table is writable with the public key). The builder model reads it before coding and the auditor before auditing. 6. Keep the old buggy commit. Whenever you change the auditor's prompt, run it against that commit; if it no longer finds the known bugs, reject the prompt change.

The author reports the audit found about 100 unique bugs and 56 code-quality issues before launch, and that the product is now live. No numbers are given on customers, revenue, or bugs found after launch.

Self-reported by the founder, who links to his product (GrantPro AI) at the end. The three AI models are not named, and the auditor prompt is not shared. The bug count cannot be checked and there is no evidence the fixes held after launch. Mixed outcome: the AI builders produced serious payment and data-exposure bugs that only a separate review caught. An AI audit is not a substitute for a security review by a person who can read the code.

Access to more than one capable AI model, a codebase in version control, and a staging setup to test payments before going live.

You are auditing, not writing features. Read this codebase and the invariants document. List every place where money, credits or user data cross between files (checkout, webhooks, credit spending, database read and write rules, exported handlers). For each, say whether an invariant can be broken, how a user could exploit it, and the smallest fix. Rank by damage if shipped.

• dev.to (bpecha14) ↗ Firsthand write-up, published October 25, 2026

Source published: October 25, 2026. Last reviewed here: October 26, 2026. Spot a mistake? Tell us.