Verify weight 2
Did you read every file the AI wrote, before you ran it?
Yes No
Reading is the one step the AI cannot do for you. Skipping it is how four hundred lines of changes you never asked for end up in your app.
Fix Look at the list of changes before you accept them, top to bottom. If it is too long to read, it is too long to say yes to.
Prompt: Show Your Work → Verify Ship-blocker weight 3
Is there a test for the important part, and did you watch it fail before it passed?
Yes No
A test is a small piece of code whose only job is to check your other code. One that has never failed has never proved anything — it might be checking nothing at all. “It runs” is not “it works.”
Fix Ask for one test that fails on purpose, aimed at the thing you actually care about. Watch it fail. Then make it pass.
Prompt: Define Done → Security Ship-blocker weight 3
Is your code free of passwords and keys, including in the old saved versions?
Yes No
A key is a password your app uses to talk to another service. Put one in your code and it is public forever — deleting it later does not take it back, because it is already sitting in the saved history.
Fix Search your files and your saved history for anything password-shaped. Move every one into settings your code reads on start-up, kept outside the files. Then go and change every key that was ever in there.
Prompt: Security Boundary → Security Ship-blocker weight 3
Does every page check who the person is, and also what they are allowed to touch?
Yes No
Most AI-built apps check who you are and forget the second half. Knowing somebody’s name is not the same as letting them into the room. That is how one customer ends up reading another customer’s files.
Fix Go through every page and say out loud who is allowed to see it. If you cannot say it, that page is open to everybody. Put the check on the server, not on the screen — anyone can edit the screen.
The Stack: the membership desk → Security weight 2
Does the server check what people type, and not just the form on the screen?
Yes No
The form on the screen is running on somebody else’s computer, and they can change it. Checking there is a courtesy. It stops nobody who is actually trying.
Fix Check the size, the shape and the type of everything that arrives at your server. Reject what is wrong. Do not quietly turn it into something else.
Prompt: Security Boundary → Verify weight 2
When something goes wrong, does your app say so out loud?
Yes No
Code that notices a problem and then does nothing about it is not handling the error, it is hiding it — and it turns every bug after that into a mystery you cannot trace.
Fix Find every place that catches a problem and then does nothing. Each one either writes down what happened, or lets it through so you find out.
Prompt: Hand It An Error → Own it weight 2
Can you say, in one sentence each, why every add-on the AI installed is there?
Yes No
AI tools reach for other people’s code the way a nervous cook reaches for salt. Each one is somebody else’s work you now have to trust and keep up to date. AI also invents packages that do not exist, and attackers register those names on purpose.
Fix List everything new that got installed. Delete anything you cannot explain in a sentence. For the rest, check it is real and check somebody still looks after it.
Prompt: Verify The Imports → Own it weight 2
Would it run on a brand new computer, following only your own setup notes?
Yes No
If it only works on your machine, you do not have an app. You have a demo.
Fix Copy it into a fresh empty folder and follow your own notes word for word. Every step you had to remember from your head goes into the notes.
Prompt: Lock the Stack → Own it weight 2
Will you find out it broke before a user has to tell you?
Yes No
With nothing watching, every problem gets reported by your angriest customer, hours after it started.
Fix Three things: something that catches errors, something that pings the site to see if it is still up, and a written record of what happened when. The free versions cover all three.
Toolbox: Utilities → Own it weight 1
Is every file under 800 lines?
Yes No
One enormous file is where the next bug hides and the next AI gets lost. Length is the cheapest warning sign there is — you can measure it without understanding a word of the code.
Fix Split it by what each part is for, not by counting lines. One job per file, so you can change one thing without shutting the whole place down.
Prompt: The Titan Audit → Verify weight 2
Did the last change touch only the thing you asked about?
Yes No
Wandering off is the AI’s default setting. Anything it changed that you did not ask for is something nobody has checked.
Fix Read the list of changes every single time before you accept it. Reject anything you did not ask for, and say so in your next message.
Prompt: Hunt Regressions → Own it weight 1
Would you put your name on it?
Yes No
Ferrari’s question. If the answer is no, you already know what needs fixing — the rest of this list is just the order to do it in.