My first backend audit found that one bad request could crash my whole server, plus 5 other silent bugs
I'm a solo founder and built my app mostly with Claude Code: Node backend on Render, Supabase, Stripe, frontend in Lovable. It's been live for months. Everything "worked", with no errors in the logs and no complaints. So I tried something: I had Claude Code do a full audit of the backend, through three lenses: security, efficiency, and silent infrastructure bugs (things that fail without telling you). It found real problems, some of them serious, in code that was largely written by Claude Code in the first place.
What turned up:
Rate limiting didn't work at all. My host sits behind a proxy, and the app wasn't configured to trust it. So every visitor looked like the same IP, and the "per user" limits were really one shared limit for everyone.
One malformed request could crash the whole server. Express 4 doesn't catch errors in async route handlers, and modern Node shuts the process down when that happens. Sending an array where the code expected a string was enough.
The Stripe webhook could lose a paid order. If the database write failed, it still told Stripe "got it", so Stripe would never retry. That order would have been charged with no record of it.
Email link scanners could unsubscribe my readers. Corporate email security tools click every link to check it, and my unsubscribe link worked on a single click.
My pricing page showed 145 models that no longer exist, and one at negative $1,000,000. The sync never removed old rows, and the upstream API uses -1 to mean "variable price". There was also a silent 1,000-row cap waiting to cut off data once the table grew.
Review averages were wrong. The database computed them correctly, then my app code recomputed them, treated missing ratings as zeros, and overwrote the right number.
What I took from it, for anyone building with agents:
- Agents write code that works on the happy path. Every one of these bugs only shows up under conditions you don't hit while testing normally: a proxy, a bad input, a failed write, a growing table.
- Ask for an audit as its own task. The same agent that missed these on the first pass found them when the only job was looking for problems, with specific lenses to look through.
- Verify, don't trust "done". I had every fix tested against the live site, not just in theory. This matters with any AI builder. I've had the frontend tool report things as finished that weren't on production.
I'm making this a routine every 2-3 months.
Curious how others maintain apps built with AI agents. Do you run audits like this, or catch issues some other way?