I Have No Coding Skills. My Team Is 3 AI Models. Here’s the 100-Bug Audit That Saved My Second Startup.

Description and use

A founder with no coding skills built GrantPro AI using three AI models. A 100‑bug audit revealed critical issues that could have destroyed the product. Fixes involved database‑level checks, server‑side credit spending, tightened RLS, and CI export tests. The platform launched successfully.

Problem

AI-generated code can contain hidden bugs that jeopardize product functionality and revenue.

Outcome

Implemented critical fixes that prevented revenue loss, ensured data security, and established a robust audit process, enabling the launch of GrantPro AI.

Workflow

• 1. Build features with AI #1 (React, Supabase, Edge Functions).
• 2. Design and infrastructure with AI #2.
• 3. Audit code with AI #3 before any user payment.
• 4. Identify 100 bugs and 56 quality issues.
• 5. Fix bugs: database idempotency, remove client-side credit logic, tighten RLS, add CI export tests.
• 6. Create Invariants Doc and regression tests for auditor.
• 7. Launch GrantPro AI with live grant tracking.

Evidence

It came back with ~100 unique bugs and 56 code-quality issues.

Source

The AI configured the Paddle webhook to listen for price IDs. But it accidentally mapped two products to the same priceId.

Source

We moved the idempotency check to the database level (Postgres unique index) instead of the application layer.

Source

The AI wrote the credit deduction in the React frontend. If the user had credits > 0, the UI let them click "Generate" and then called the Edge Function.

Source

We deleted all client-side credit logic. Spending now happens exclusively via a Postgres SECURITY DEFINER RPC that checks the user's balance atomically on the server.

Source

The AI enabled Row Level Security (RLS), but left the SELECT policy open to the anon role for caching purposes.

Source

We dropped the public read policies. If a table contains the "secret sauce" (historical awards, win probabilities), it is locked to service_role or authenticated users only.

Source

The AI forgot to export the handler (export default async function...). The function compiled, but when called by the frontend, it silently failed.

Source

We added a CI gate that explicitly tests the exports of every Edge Function before deployment.

Source