u/No_Dragonfruit3391

Every week, same thing: “Built a SaaS in 3 days with Cursor 🚀”, pretty dashboard, 400 upvotes. Then you start charging for it — and find out the entire hard part is still missing.
A few things that are absent from basically every one of these projects. Honest question: how are you handling this?
Auth. Someone increments the user ID in your API and sees other people’s data. Does your backend actually check that — or are you hoping the AI wired up “something with auth”?
Secrets. Stripe key or DB credentials sitting in the frontend bundle or a public repo. You wouldn’t even know.
Migrations. Live DB, 200 real users, you need to change one field. Now what?
Compliance. Real users means real data laws — where it’s stored, who you share it with, deleting it on request. For EU users that’s GDPR and it’s not optional. “I’ll deal with it later” is a fine with a date on it.
Cost. Every click fires a GPT-4 call, no rate limit. Someone writes a 10-line script and you wake up to a four-figure bill. Who’s paying that?
Backups. “I have backups.” Have you ever tested a restore? No? Then you don’t have a backup, you have a feeling.
When the AI can’t fix the bug. It loops, changes random lines, makes it worse. You can’t read the code because you never read it. Who debugs that — hope?
This isn’t gatekeeping. It’s the bare minimum between “prototype” and “something you can actually charge money for.” And it’s exactly the part no tool does for you — because it’s the part where you have to understand what you’re doing.
So, genuinely: how do you deal with this stuff? Or is the plan “I’ll fix it when it breaks”?
(And before someone says “works fine for me” — yeah. Everything works fine at 5 users.)

Every week, same thing: “Built a SaaS in 3 days with Cursor 🚀”, pretty dashboard, 400 upvotes. Then you start charging for it and find out the entire hard part is still missing.
A few things that are absent from basically every one of these projects. Honest question: how are you handling this?
Auth. Someone increments the user ID in your API and sees other people’s data. Does your backend actually check that or are you hoping the AI wired up “something with auth”?
Secrets. Stripe key or DB credentials sitting in the frontend bundle or a public repo. You wouldn’t even know.
Migrations. Live DB, 200 real users, you need to change one field. Now what?
Compliance. Real users means real data laws where it’s stored, who you share it with, deleting it on request. For EU users that’s GDPR and it’s not optional. “I’ll deal with it later” is a fine with a date on it.
Cost. Every click fires a GPT-4 call, no rate limit. Someone writes a 10-line script and you wake up to a four-figure bill. Who’s paying that?
Backups. “I have backups.” Have you ever tested a restore? No? Then you don’t have a backup, you have a feeling.
When the AI can’t fix the bug. It loops, changes random lines, makes it worse. You can’t read the code because you never read it. Who debugs that? hope?
This isn’t gatekeeping. It’s the bare minimum between “prototype” and “something you can actually charge money for.” And it’s exactly the part no tool does for you, because it’s the part where you have to understand what you’re doing.
So, genuinely: how do you deal with this stuff? Or is the plan “I’ll fix it when it breaks”?
(And before someone says “works fine for me” yeah. Everything works fine at 5 users.)