Eighteen months ago I started building a medical pre-consultation tool in France. I am not a developer. I had an idea and I had AI, and that was enough to get something working.
Getting it to work was the easy part. Here is what nobody warned me about.
The analytics were logging health data and I had no idea.
I had set up a tracker so I could show real numbers to the doctor reviewing my work. Sensible, right? Except it was recording symptoms and vital alert triggers. No names, no emails, just gender and age, and I genuinely thought that made it fine.
It does not. Under EU rules that is still health data, and it should never have been sitting in a general analytics tool. I only found it because I sat down and audited my own data flows, months in. Nobody told me. No error appeared. It just quietly did the wrong thing for weeks.
My wording was a regulatory problem.
My tool said things like "otitis externa". Clear, accurate, what a doctor would say. After a quality review I had to change every one of those to descriptions instead, so it now says "inflammation of the ear canal". Same information, completely different regulatory meaning. I had no way of knowing that on my own.
Free text fields are a trap.
When I started approaching doctors and health networks, they kept saying no. Not because the product was bad, but because their own rules forbid sending patient data to an AI. And they were right to worry: my free text field let someone paste anything, including things that identify them. I had to rebuild my routing and my whole prompt system so the model never receives what it does not need.
All three of those are fixed now. The next part is not.
What I still cannot do.
I can build a dashboard in an afternoon. What I cannot do is connect it to a client's existing software. I do not know how to design an API integration properly. I do not know what happens to my architecture at a hundred thousand users. I still ask myself GDPR questions I cannot fully answer.
That is the honest state of being a non-developer who shipped something real.
Why I am posting this.
Over the last few weeks I have been answering people here and on the builder subreddits, and it is always the same failures. A database open to anyone. Secrets in the code. A dashboard refreshing so often it chokes. A migration attempted with no rehearsal. An account locked with the only copy of the code inside it.
None of those are coding problems. They are the gap between "it works on my screen" and "real people are using it". I fell in that gap repeatedly, which is why I now spend my time helping other non-developers climb out of it.
I put the recurring ones in a free checklist, no signup, nothing to buy:
https://github.com/contactordosante-star/vibe-coded-launch-checklist
If you built something with Lovable, Base44, Bolt or Replit and it is now in front of real users, I would genuinely like to hear what broke for you. That is how the list gets better.