Do you know the best practices for deploying and running vibe-coded apps?
10 quick questions on shipping apps built with AI assistants: secrets, access, owners and what to keep a record of. Pick an answer and you’ll see why it’s right, with the guideline behind it.
Question 1 of 10
Your app works on your laptop and the team wants it. How do you share it?
Ship the way your company has approved, with sign-in in front. That’s how IT knows the app exists and who can open it.
Question 2 of 10
Your assistant asks for a Salesforce API key to test a connection. What do you do?
A pasted key has copies: the chat, the config, the repository history. Connect the approved way and the credential never reaches you.
Question 3 of 10
You pasted a token into a prompt, then deleted it. Now what?
Once a secret has been in a prompt, a file or a repository, assume it’s been copied. Rotating it is the only fix.
Question 4 of 10
Your assistant added a library you didn’t ask for. What do you do?
Read each change before you accept it. Watch for libraries you didn’t ask for and code that sends data somewhere you didn’t expect.
Question 5 of 10
Who should be able to open an internal AI-built app?
No open links for internal apps. Put sign-in in front, grant access app by app, and add people when they need it.
Question 6 of 10
People keep shipping apps from personal accounts. What fixes it?
People take the fastest route to a working app. If the approved way is slower, fix that first. Blocking assistants pushes the work out of sight.
Question 7 of 10
A finance analyst builds a personal report, then an app that writes to the general ledger. Same tier?
Tiers follow data sensitivity and business impact. Keep the low tiers light so the controls on the high ones stay credible.
Question 8 of 10
What should trigger a second look at an app that’s already live?
Apps grow one step at a time: a team, then a department, then a system of record. Each step can move an app up a tier.
Question 9 of 10
Who owns an AI-built app once it’s in production?
Every production app has a named owner. Write down who takes over when they move on, and switch off apps no one uses.
Question 10 of 10
An auditor asks what an app did last Tuesday. What should your records answer?
Logs for every run, plus a record of who deployed and who has access, answer all four in minutes.
The guidelines behind your misses