Your Claude app works.
Now make it survive real users.

How it fails

• Login works, but permissions are only enforced by hiding buttons in the UI
• Sequential IDs let any signed-in user read someone else’s records
• Tokens in localStorage, no expiry, rotation, or revocation story

What I put in place

• Server-side authorization on every route, tested with cross-tenant attempts
• Hardened sessions (httpOnly, rotation, revocation) or a managed IdP with SSO
• Roles and tenancy modeled in the data layer, not bolted on in the front end

How it fails

• API keys (including LLM keys) shipped in the client bundle or committed to git
• No input validation, wide-open CORS, no rate limiting, no security headers
• Untrusted text flowing into prompts and tools with no injection boundary

What I put in place

• Secrets in a manager, keys proxied server-side, history scrubbed and rotated
• Schema validation at every boundary, CSP and header baseline, per-user rate limits
• Threat model for the agent surface: least-privilege tools, output handling, audit logs

How it fails

• Client-rendered SPA: the HTML that crawlers and link previews fetch is blank
• One title and description for every route; no canonical, sitemap, or robots
• Slow first paint and layout shift tanking Core Web Vitals

What I put in place

• SSR, SSG, or prerendering matched to how often the content changes
• Per-route metadata, canonical URLs, Open Graph, structured data, sitemap
• Performance budget: image pipeline, font loading, caching and CDN headers

How it fails

• Production is whatever was last pushed from someone’s laptop
• No tests gating merges, no preview environments, no way to roll back
• Config drift between local, staging, and prod; migrations run by hand

What I put in place

• Pipeline that lints, type-checks, tests, and builds on every pull request
• Preview deploys, environment parity, migrations as a reviewed, gated step
• Progressive rollout with a rollback you have actually rehearsed

How it fails

• Schema shaped by whatever the last prompt produced; no migration history
• Backups that were never restored, or never configured at all
• Missing indexes and N+1 queries that only show up at ten users

What I put in place

• Versioned migrations, constraints, and a data model you can reason about
• Automated backups with a restore drill and defined recovery targets
• Query review, indexing, and connection pooling sized to real load

How it fails

• console.log is the monitoring stack
• Users find outages before the team does
• No runbook, no on-call, no idea what “normal” looks like

What I put in place

• Structured logs, tracing, and error tracking wired to real alerts
• A few SLOs that matter, dashboards a human can read at 3am
• Runbooks for the failures you’ve actually seen, plus a blameless review habit

How it fails

• Unbounded tokens, no timeouts or retries, no per-user spend cap
• Prompts changed by feel; no evals, so regressions ship silently
• Hard-coded model IDs that will be deprecated on someone else’s schedule

What I put in place

• Budgets, caching, backoff, and graceful degradation when the API is down
• An eval set that gates prompt and model changes like any other test suite
• A thin provider boundary so upgrading a model is a config change

How it fails

• Zero tests; correctness depends on whoever is re-reading the diff
• 3,000-line files and three copies of the same logic
• Dependencies pinned to whatever the model remembered

What I put in place

• Characterization tests around what works, then refactor behind them
• Clear module boundaries, lint and type gates, dependency update automation
• Docs and ADRs so the team can own the code without me