What AI-built apps tend to miss
The happy path is usually solid, because it's the one you kept prompting about. The trouble is everything around it: the second user, the empty account, the form submitted twice, the phone in landscape, the session that expires mid-task.
Security is the quiet one. Generated back ends often ship with database rules wide open or API keys in the browser bundle, because nobody asked for anything else. Testers aren't a security audit, but they do notice when they can see someone else's data.
Prompting can't replace a stranger
You can ask the model to test its own code, and you should. But it tests what it thinks the app does. A person who has never seen it tests what it actually does, and tells you where they got lost, which no unit test covers.
What to put in your brief
- The tool you built it with, so testers know where to look (Supabase rules, env variables, generated forms).
- Two accounts or a way to create them, so testers can check one user can't see another's data.
- The one task a new user must be able to finish.
- What you already know is broken, so nobody reports it twice.





