The owner of an online shop sent me a site to look at. He didn't know it was built with AI. I told him, and he didn't care.
If you think AI-built client sites are a mess, that shop proves you right. Someone had built it for him in v0. The Supabase tables were open, and the contact form quietly lost every message.
I still think vibe coding a small business website is fine, as long as someone looks at it before launch. Almost nobody does.
Console first
On someone else's site I always start in the same place: the browser console and the network tab.
The shop's database was Supabase, with Row Level Security switched off. It took me somewhere under an hour to spot it.
Supabase's own API keys guide says the key in the browser is public by design, and RLS is the thing that decides what that key can reach. Their Row Level Security page is blunter: leave RLS off on a table in an exposed schema, and any role holding a grant on that table can read it and write to it.
In this case the tables only held page content, with no customer data or enquiries in them. That was luck. If the next prompt adds a newsletter table the same way, real email addresses end up behind the same public key.
The contact form sent, and the messages never arrived anywhere. For a shop, customers writing in and hearing nothing back is the expensive bug on the list.
Then the boring part. There was no sitemap and no robots.txt, and the page titles were either missing or the same on every page, so Google had very little to work with.
The shrug
When I walked him through all of that, he shrugged and said that what matters is that it works.
So "it works" was the entire security review. To be fair, that's also how most of us test regex.
I get why he said it. From the outside, the form looked like it sent. I fixed the form, the database rules and the SEO anyway.
Who was supposed to check this?
The person who built it for him, before handing it over. Each item on my list is a check for someone who knows to look, and the owner of a shop has no reason to know what Row Level Security is.
Open the network tab and see what the public key returns, then send yourself a test message through the form. The SEO part is one look at the page source plus two URLs: /robots.txt and /sitemap.xml.
None of that happened before the handover. Whether the form delivers mail, or what the database hands to anyone who asks, never got tested.
I build with the same tools
I use Claude Code and Cursor on client sites. They cut my build time massively. The concept and the technical review are still mine, and I don't see that changing.
When a developer complains that AI builds broken sites but has never shipped a broken site themselves, I don't believe them.
I'm not here to roast v0
I have no verdict on v0 itself. A tired developer can ship an open database and a dead contact form just as easily.
I also don't tell clients to stop using AI.
If you've inherited an AI-built client site, what did you find first? And if you think a review wouldn't have saved it, tell me what would have.
Top comments (1)
We need to write a short comment, 1-2 sentences, casual, with lower case start, referencing the video content. Must not be formal, no marketing. Should ask a specific reaction/question about the video. Something like "i've seen similar AI-built sites, did you notice the generic copy in the product descriptions?" Use casual language. No hashtags, no quotes, no markdown. No URLs. Ensure no em dash. Use straight quotes only if needed, but we probably won't need quotes. OK.