Should I rewrite or patch my AI-built app?
Patch when findings are individual missing checks, exposed keys or configuration. Rewrite a component when the problem is structural: no tenant field in the data model, authorization scattered through the interface with nothing on the server, or core logic nobody can explain. Most AI-built apps need patches, sometimes a rewrite of one area, rarely a full rebuild.
Signs
| Finding | Usually |
|---|---|
| Missing ownership checks on some endpoints | Patch |
| RLS off or too permissive | Patch |
| Keys in the front end | Patch and rotate |
| No concept of organization in a multi-tenant app | Rewrite the data model |
| Permissions only in the interface everywhere | Rewrite the API layer |
| Payment state spread across client code | Rewrite billing |
Ask the tester
A good tester will say which findings share a root cause. Ten IDOR findings from one missing pattern is one structural fix, not ten patches.
Making the call
Group the findings by root cause before deciding. Ten findings that are all "endpoint does not check ownership" are one pattern: add a shared helper that loads records only for the caller's organization and route every query through it. That is a refactor, not a rewrite. A rewrite is justified when fixing the pattern would touch nearly every file anyway, or when the data model cannot express the rule, for example when records have no organization column at all.
If you rewrite, do it in a branch, keep the old version running, and have the rewritten area retested before switching over. Write the rules down first, in plain language, and give them to the AI tool as the specification: who owns what, who can see what, who can change what. Most structural problems in AI-built apps trace back to those rules never having been stated.
Getting it checked
TrazTech offers vibe-coding QA and security review, listed from $2,000 CAD. Get at least one other quote on the same scope; the questions to ask a testing firm help compare them.
Related questions
- Can AI fix its own security bugs?
- How do I keep customers' data separate?
- Build cheap, test properly
Get a scope for your app
Tell us what you built, what it stores and who is about to use it.
Get matchedCommon questions
Can the AI do the rewrite?
Often, given a clear design. Have the result tested again.
Is a rewrite a failure?
No. Finding it before customers depend on it is the cheap outcome.