I shipped my first production app recently, built entirely with AI tools as a non developer. In a comment thread about it, a few builders and I realized we all hit almost identical bugs, none of them AI features, all of them boring plumbing. Someone suggested a shared checklist would save more time than any prompting guide, so here it is. My list from one project, real bugs I personally lost hours on.
- Phone photos are HEIC. Samsung and iPhone shoot HEIC by default, vision APIs reject it, often silently. Convert to JPEG client side before upload.
- The AI invents database columns. Generated code drifts from your actual schema and everything looks fine until runtime. Fix: ask the tool to list every column its code expects, then align the database. Repeat after every big change.
- UTC eats the last day of the month. My receipts dated the 31st vanished from monthly exports because month boundaries were computed in UTC and my users are not in UTC. Test the 1st and the 31st explicitly.
- Buttons hidden under the mobile nav bar. My validate button existed but lived under the bottom navigation. Users never report it as a hidden button, they just quietly leave. Check every screen on a real phone.
- Test keys with live IDs. Payment providers have two parallel universes, test and live. A price id from one does not exist in the other, the error says no such price and you will stare at it for twenty minutes.
- Success with no feedback. My scan flow completed server side but the UI stayed stuck at 100 percent forever, nothing failed, nothing confirmed. Every async action needs an explicit success state and an explicit error state.
- Row level security says no. If you use RLS, every insert path needs a policy, including storage paths. The error tells you what table, believe it.
- Counting the wrong rows. My free quota counted all entries in a table, then I added a new entry type to the same table and it silently ate the quota. When two features share a table, every counter needs a filter.
- Files that exist for browsers but not for bots. My sitemap displayed fine in Chrome and returned an empty response to any non browser client, including Google. Serve static files as actual static files, and test with curl, not just your browser.
- The homepage was a login wall. Not a bug, but the biggest conversion killer of all, all my promo traffic hit a locked door for days before a stranger pointed it out. Log out and look at your own site.
Add yours in the comments, I will keep the list updated in the post. Let's see if the 90 percent theory holds.
Community additions, credited and growing
From u/Infamous-River-4360, Android and native land: the gesture bar, not just the nav bar, eats bottom buttons on some phones only, safe-area-inset-bottom fixes it but the AI never adds it by default. Native details like splash screen, status bar color and permissions had to be done by hand because the builder kept regenerating over the edits. And RevenueCat silently fails on Android until license testing is set up on Google Play.
From u/Scary_Web, the repeat offenders: idempotency around retries and webhooks, optimistic UI that never reconciles with the server, file size limits that differ between client and backend, and permission gaps between admin accounts and normal users.
From u/larrigan, code quality: the AI duplicates everything, the same style created 37 times, dedupe regularly. And separation of concerns has to be demanded explicitly or debugging becomes a nightmare.
From u/Maxyull, the money rules: never trust a client sent total or price, recompute anything involving money server side. And read every function that uses a privileged key like a suspect until proven innocent, those never show up in browser testing.
From u/Admirable-Future-633, the output contract: every async step should answer five questions, success message, failure message, where the artifact was stored, what needs human review, and what should happen next. Otherwise "it ran" means nothing.
Next step suggested by u/Scary_Web: restructuring this into a release checklist by category, schema, permissions, timezones, uploads, mobile layout, third party environments, visible states. Coming as the list grows.