AI built the app fast. A review caught seven problems first.
A public agency had a useful new tool built largely with AI. Before it shipped, we ran it through our gated code-review system. Here is what that caught.
release-blocking problems fixed before production.
The challenge
A public agency had a genuinely useful new internal tool: a document-intelligence application that read incoming files and moved them through a workflow that used to be manual. Most of it had been built with AI, the kind of fast, AI-assisted "vibe code" that gets a working app standing up in a fraction of the usual time.
Speed is the appeal, and it is real. The risk is just as real. Software that comes together that fast can ship serious problems that no one notices, because no one read the code with a cold, critical eye. Those problems do not announce themselves. They sit quietly until the day someone finds them, and by then the tool is in production with real data flowing through it.
What we did
We ran the application through our AI code review system, the same gated relay our own engineers use on the work we ship. It reads the codebase cold, with no attachment to how the thing was built, and flags issues by severity so the most dangerous problems rise to the top.
The review surfaced seven release-blocking problems. Among them was an open API endpoint with no authentication, meaning anyone who found the address could reach it. It flagged missing security protections that should have been standard, error handling that swallowed failures silently so the app looked fine while quietly breaking, and accessibility gaps that would have shut out some of the people the tool was meant to serve. AI had built the app quickly, but it had also left a public security hole in plain sight.
The outcome
The agency fixed the seven issues and shipped a working, safe tool instead of a public exposure waiting to be found. None of the flagged problems reached production. The open endpoint got locked down, the missing protections went in, the silent failures were made visible, and the accessibility gaps were closed.
The point worth holding onto is that the review did not slow the project down. The agency kept the speed of AI-assisted development, the whole reason they built it this way, while a person stayed accountable for security and quality. AI accelerates the building. A gated review keeps the result safe. You do not have to trade one for the other.
Building with AI? Keep the speed and lose the risk. A gated code review reads your application cold and tells you what has to be fixed before it ships. That is where we start.