Production Readiness Glossary for AI-Built Apps

Plain-English definitions for the concepts, patterns, and vulnerabilities you run into while shipping vibe-coded and AI-built apps. Every term links back to the blog posts and scans that reference it.

A

AI-Built App

A web or mobile application where most of the code was generated by an AI tool rather than written by hand.

concept

Auth Bypass

A vulnerability where a user can access or modify resources they should not, because the app checks who you are but not what you are allowed to do.

security

C

Core Web Vitals

Google's three user-experience metrics (LCP, INP, CLS) that measure loading speed, interactivity, and visual stability, and that feed into search rankings.

performance

E

Edge Function

A server-side function deployed to a global edge network, running close to the user with lower latency and different constraints than serverless.

deployment

Environment Variable

A named value set outside your code (at build time or runtime) used to configure your app without hardcoding secrets or per-environment settings.

security

Error Boundary

A React component that catches JavaScript errors in its child tree and renders a fallback UI instead of crashing the whole app.

stability

F

Finish Plan

The prioritized list of issues blocking a production launch, grouped by severity with auto-generated fixes, produced by FinishKit after reviewing a repo.

finishkit

H

Hydration Mismatch

A React error that happens when server-rendered HTML does not match what React renders on the client, breaking interactivity or forcing a full re-render.

stability

I

IDOR

Insecure Direct Object Reference, a class of vulnerability where changing a resource id in a URL or request gives access to someone else's data.

security

P

Production Readiness

The measurable state of an application being safe to expose to real users, covering security, reliability, performance, observability, and completeness.

concept

Prompt Injection

A class of attack on LLM-powered features where adversarial input to the model causes it to ignore developer instructions and behave maliciously.

security

R

Rate Limiting

Restricting how often a single user or IP can call an API endpoint, to prevent abuse, protect downstream systems, and control cost.

security

Row Level Security

A database feature that limits which rows a user can read or change based on per-row policies, enforced by the database rather than application code.

security

S

Secret Exposure

A sensitive credential (API key, database password, private key) visible where it should not be, such as client bundles, git history, or server logs.

security

V

Vibe Coding

Building software by describing what you want to an AI, accepting most generated code without deep review, and iterating on feel rather than architecture.

workflow