The first review came back with 29 problems in the code and 13 legal or privacy risks. I had built the app myself, with AI agents doing most of the typing, and I thought it was close to finished.
The app is called SlotSaver. When a customer cancels an appointment at a dog grooming salon, it looks for other customers who agreed to receive messages and prepares a WhatsApp text. The owner sends it with one tap. It runs on Cloudflare's free plan, so hosting costs nothing. Before a real salon touched it, I wanted a reader who had not written the code to try to break it. I used an AI reviewer that is separate from the agent that built the app, with read-only access: it can read the code and test the live site, and it cannot edit files or deploy anything.
The first round found the serious things. The security policy I had added told the browser to refuse inline scripts, and SvelteKit starts every page with one, so the pages appeared but never came alive. The send button took the phone number and the message text from the form and trusted both. Logins could fail with a server error, because my password hashing asked for more iterations than the platform allows.
The second round found that the Exit button did not log anyone out. I had renamed the session cookie after the first round, and the logout code still deleted the old name. Every test I had passed.
The third found a customer I had deleted for privacy reasons coming back with the next Excel import. The fourth found that a slot at 10:00 showed up in the message as 09:00.
I gave the reviewer one standing instruction: read the earlier reports to see what is claimed as fixed, then check the code and the live site yourself. That instruction paid off. One of my own reports said a webhook now verified signatures. The verification function existed and nothing called it. The reviewer sent an unsigned request and got a success answer.
Between rounds I fixed what it found, and the automated tests went from 34 to 105. After the sixth round a separate session ran an acceptance test on fake data, 61 scenarios, which I'll write about in another post.
What I took from it is that the person who writes a fix should not be the one who declares it done. A reader with read-only access and permission to be suspicious sees things I no longer see, because I wrote them.
Disclosure: drafted with a local AI model, then reviewed and approved by me. Originally published at https://bbal-blog.kairo-app.workers.dev/six-review-rounds-for-one-small-app/
Top comments (0)