Case Study: When AI Accelerates the Wrong Part of a Software Project

AI can be exceptionally effective at accelerating ideation, documentation, interface exploration, and prototyping.

However, production software requires decisions that extend beyond generating code. Architecture, security, compliance, infrastructure, authentication, maintainability, and operational planning all require deliberate engineering choices that cannot be reliably inferred by AI from isolated prompts.

We have seen the greatest value come from combining AI-assisted planning with experienced technical oversight. When AI is used to enhance expertise rather than replace it, projects move faster without sacrificing reliability, security, or future maintainability.

Project Background

A prospective client approached us at Apis Productions with what appeared to be a nearly complete web application. They had invested several weeks using multiple AI and LLM tools to generate:

• Product requirements
• User interface mockups
• Database schemas
• Front-end code
• Authentication workflows
• Deployment instructions

The client believed approximately 80% of the project was complete and requested assistance with deployment, hosting, and a few finishing touches.

After reviewing the materials, it became clear to us that the project would require substantially more work to close the 20% gap than it would have if we rebuilt it correctly from the beginning.

What Went Well

AI proved valuable for several early-stage tasks. The client’s industry expertise proved invaluable in designing a functional prototype and AI gave them the tools to express it with ingenuity.

The client arrived with:

These documents significantly shortened the discovery process and helped communicate business goals effectively, cut the overall project cost, and kept the project true to the client’s original vision. 

Example 1: Security Was Treated as a Feature

The application stored customer information, invoices, and employee records.

However:

• Sensitive information was stored without proper encryption.
• Authentication tokens remained valid indefinitely.
• Password reset links never expired.
• User permissions were enforced only in the browser instead of on the server.
• Administrative endpoints were publicly discoverable.

The application appeared functional during demonstrations but would have exposed confidential data if deployed. AI was unable to identify or remedy the risk it created.

Example 2: Handling of Personally Identifiable Information

The business intended to collect:

• Names
• Addresses
• Phone numbers
• Email addresses
• Customer notes
• Uploaded documents

information into a single, unencrypted table without considering:

• Data retention policies
• Privacy regulations
• Access controls
• Audit logging
• Encryption requirements
• Separation of sensitive records

What looked like a simple customer database represented significant compliance and security risks. AI was unable to apply known best practices and security protocols.

Example 3: Single Sign-On Was Only Partially Implemented

The client requested Single Sign-On so employees could use existing company credentials. AI generated an OAuth login screen that appeared convincing.

However, the implementation lacked:

Employees could sign in initially, but identity was never securely verified after login.

From a user’s front-end perspective, the feature appeared complete, but from a back-end security perspective, it was incomplete and left a door open to potential attacks.

Example 4: Hosting Assumptions

The generated deployment instructions assumed:

• Unlimited server memory
• Local file storage
• Persistent containers
• Unlimited execution time
• Open firewall rules

The target hosting platform and budgets could not answer for these assumed requirements. Significant portions of the application would fail in production under real conditions despite functioning correctly on a local development machine. 

Example 5: AI Produced Code That Could Not Be Maintained

The project contained thousands of lines of generated code.

Although the application compiled successfully:

• Similar functionality had been implemented four different ways.
• Variable naming conventions changed between files.
• Business rules were duplicated across multiple modules.
• Libraries were outdated or abandoned.
• Generated comments contradicted the implementation.
• No automated testing existed.

Future developers would need to reverse-engineer the application before making even small modifications. The cost of future maintenance exceeded the cost of proper initial development.

Example 6: Hidden Technical Debt

The client estimated the remaining work would require approximately two weeks.

A technical review identified additional tasks including:

None of these items were visible in the user interface, yet each was essential before production deployment and would certainly take longer than the two-week expected timeframe.

The Outcome

Rather than attempting to repair the generated application after consultation, Apis Productions recommended preserving the valuable planning strategy while rebuilding the software on a properly designed foundation.

The AI-generated materials remained useful as documentation and design references.

The production implementation focused on:

• Secure architecture
• Maintainable code
• Scalable infrastructure
• Proper authentication
• Regulatory compliance
• Long-term maintainability

The final result matched the client’s original vision while providing a platform that could safely evolve as the business grew.

Conclusion

For Apis Productions, we view AI as a powerful design and productivity tool—not as a replacement for software engineering. While the capabilities of AI are growing on an almost daily basis, the ability of human operators to effectively outline all requirements of a project and successfully prompt AI to understand them is not a factor of technology, but of training and human experience. 

As AI moves forward, successful projects will leverage both modern AI capabilities and experienced technical judgment to deliver systems that are secure, scalable, and built to last, at least for the foreseeable future.