Category
AIで作ったアプリの運営 — Claude Code / Cursor / Lovable で作った人が、安全に公開・運用するための非エンジニア向けガイド
「動いている。でも、このまま公開して大丈夫か分からない」——これは能力の問題ではなく、AIが教えてくれない領域があるという構造の問題です。AIは動くコードを速く書きますが、「誰がどのデータを見られるか」「二重に課金されないか」「壊れたとき戻せるか」は指示しない限り実装しません。本クラスタは、コードが読めないことを前提に、公開前に確認すべきことを危険な順に並べます——データベースの権限（RLS）、APIキーの露出、ログインと認可の違い、決済の冪等性、静かに間違う業務ロジック、従量課金の暴走、個人情報保護法と特定商取引法、そしてエンジニアに引き継ぐときの準備。すべての専門用語は初出時に日常語で言い換え、各項目に「自分で直すならこうする」と「AIにそのまま貼れる修正指示」を添えます。開発者としてより深く踏み込みたい方は、姉妹クラスタ『バイブコーディング』（/blog/category/vibe-coding）へどうぞ。
10 articles in total
Foundational guide
Foundational guide (start here)
Before you launch the app you built with AI — a complete pre-launch guide for non-engineers
You built an app with Claude Code, Cursor, Lovable, v0 or Bolt, and you can't tell whether it's safe to launch. This guide lists what to check before you go live, ordered by what can actually hurt you. Every technical term is translated into plain language, and each item comes with how to fix it yourself plus an instruction you can paste into your AI tool.
Related practical articles
- バイブコーディングセキュリティ脆弱性診断個人開発Supabase
Does the app you built with AI need a human security review? — who needs one, who doesn't, and what it costs, when to do it and how to ask
Should you pay a person to review the app you built with Claude Code, Cursor or Lovable? A decision table based on the data you hold, what an AI self-check covers and what it can't, when in the launch cycle to ask, typical prices and what drives them, and how to get a review without handing over keys or customer data.
17 min read - バイブコーディングセキュリティNext.jsSupabase個人開発
NEXT_PUBLIC_ and service_role — why the "API key" AI wrote is visible to everyone else
How AI-generated code ends up leaving API keys and passwords readable by anyone, explained for non-engineers. What NEXT_PUBLIC_ actually does, the decisive difference between Supabase's anon and service_role keys, and why a key ever pushed to GitHub must be reissued. Includes checks and an instruction for your AI tool.
8 min read - バイブコーディング個人開発VercelインフラAI
The bill spiked after launch — usage-billing incidents, and how to cap them
Why cloud and AI API costs run away after you launch an app built with AI, explained for non-engineers. The five patterns that spike, how to set caps on Vercel, Supabase and AI APIs, and how to add rate limiting.
8 min read - バイブコーディング個人開発発注セキュリティ
Personal data, commercial disclosures and privacy policy — the legal check before selling an AI-built app
What you need legally before launching and charging for an app you built with AI, organised for non-engineers. Why a privacy policy is required from the first email address you hold, the mandatory items in Japan's commercial-transaction disclosure, and what to watch when you use external services such as AI APIs, analytics and payments.
9 min read - バイブコーディング決済セキュリティ個人開発信頼性
Why double-charging happens when you let AI build payments, and how to prevent it
How payment code written by AI ends up charging customers twice, explained for non-engineers. Why webhooks arriving more than once is by design, what idempotency means, why the amount must never come from the browser, and why signature verification matters. Grounded in a payment platform that has held double-charges at zero in production.
8 min read - バイブコーディングAI駆動開発型安全個人開発テスト
"It runs, but it's wrong" — the quietest and most common AI-generated bug
The most common defect in AI-written code isn't a vulnerability — it's a result that is simply wrong while nothing errors. Totals that don't add up, search results that drop rows, failures reported as successes: how they happen, and how to find them without reading code.
9 min read - バイブコーディングセキュリティ認証・認可個人開発Next.js
Is the login AI built for you real? — "looks logged in" versus a real permission check
You have a login screen, and other people's data is still visible — the most common vulnerability in AI-generated apps, explained for non-engineers. How to confirm it using nothing but a browser, why OWASP ranks it the number one API risk, and an instruction to paste into your AI tool.
7 min read - バイブコーディング発注見積もり受託開発個人開発
Handing an AI-built app or internal business system to an engineer — what to provide, how to share it safely, and what drives the quote
What to prepare, from the buyer's side, before an engineer reviews or takes over an app or internal business system built with Claude Code, Cursor, Lovable and similar tools: the documents to provide (five basics plus three for business systems), how to share keys and personal data safely, a table of what drives the quote, what a specialist does first, and a checklist.
17 min read - バイブコーディングセキュリティSupabaseデータベース個人開発
What is Supabase "RLS"? — how AI-built apps end up with all their data public, explained without code
"ChatGPT told me to enable RLS but I don't know what that means." This explains what Row Level Security is, and why without it every user's data is readable by anyone — no code reading required. Includes how to check your own project and an instruction to paste into your AI tool.
8 min read