Category
AIで作ったアプリの運営 — Claude Code / Cursor / Lovable で作った人が、安全に公開・運用するための非エンジニア向けガイド
「動いている。でも、このまま公開して大丈夫か分からない」——これは能力の問題ではなく、AIが教えてくれない領域があるという構造の問題です。AIは動くコードを速く書きますが、「誰がどのデータを見られるか」「二重に課金されないか」「壊れたとき戻せるか」は指示しない限り実装しません。本クラスタは、コードが読めないことを前提に、公開前に確認すべきことを危険な順に並べます——データベースの権限（RLS）、APIキーの露出、ログインと認可の違い、決済の冪等性、静かに間違う業務ロジック、従量課金の暴走、個人情報保護法と特定商取引法、そしてエンジニアに引き継ぐときの準備。すべての専門用語は初出時に日常語で言い換え、各項目に「自分で直すならこうする」と「AIにそのまま貼れる修正指示」を添えます。開発者としてより深く踏み込みたい方は、姉妹クラスタ『バイブコーディング』（/blog/category/vibe-coding）へどうぞ。
9 articles in total
Foundational guide
Foundational guide (start here)
Before you launch the app you built with AI — a complete pre-launch guide for non-engineers
You built an app with Claude Code, Cursor, Lovable, v0 or Bolt, and you can't tell whether it's safe to launch. This guide lists what to check before you go live, ordered by what can actually hurt you. Every technical term is translated into plain language, and each item comes with how to fix it yourself plus an instruction you can paste into your AI tool.
Related practical articles
- バイブコーディングセキュリティNext.jsSupabase個人開発
NEXT_PUBLIC_ and service_role — why the "API key" AI wrote is visible to everyone else
How AI-generated code ends up leaving API keys and passwords readable by anyone, explained for non-engineers. What NEXT_PUBLIC_ actually does, the decisive difference between Supabase's anon and service_role keys, and why a key ever pushed to GitHub must be reissued. Includes checks and an instruction for your AI tool.
8 min read - バイブコーディング個人開発VercelインフラAI
The bill spiked after launch — usage-billing incidents, and how to cap them
Why cloud and AI API costs run away after you launch an app built with AI, explained for non-engineers. The five patterns that spike, how to set caps on Vercel, Supabase and AI APIs, and how to add rate limiting.
8 min read - バイブコーディング個人開発発注セキュリティ
Personal data, commercial disclosures and privacy policy — the legal check before selling an AI-built app
What you need legally before launching and charging for an app you built with AI, organised for non-engineers. Why a privacy policy is required from the first email address you hold, the mandatory items in Japan's commercial-transaction disclosure, and what to watch when you use external services such as AI APIs, analytics and payments.
9 min read - バイブコーディング決済セキュリティ個人開発信頼性
Why double-charging happens when you let AI build payments, and how to prevent it
How payment code written by AI ends up charging customers twice, explained for non-engineers. Why webhooks arriving more than once is by design, what idempotency means, why the amount must never come from the browser, and why signature verification matters. Grounded in a payment platform that has held double-charges at zero in production.
8 min read - バイブコーディングAI駆動開発型安全個人開発テスト
"It runs, but it's wrong" — the quietest and most common AI-generated bug
The most common defect in AI-written code isn't a vulnerability — it's a result that is simply wrong while nothing errors. Totals that don't add up, search results that drop rows, failures reported as successes: how they happen, and how to find them without reading code.
9 min read - バイブコーディングセキュリティ認証・認可個人開発Next.js
Is the login AI built for you real? — "looks logged in" versus a real permission check
You have a login screen, and other people's data is still visible — the most common vulnerability in AI-generated apps, explained for non-engineers. How to confirm it using nothing but a browser, why OWASP ranks it the number one API risk, and an instruction to paste into your AI tool.
7 min read - バイブコーディング発注個人開発受託開発
Preparing to consult or hand over to an engineer — getting your AI-built app into a state someone else can touch
What to prepare before consulting or handing over an app built with Claude Code or Lovable, so the quote comes back faster and more accurately. The five things to give an engineer, what not to give, the patterns that make quotes expensive, and the questions you'll be asked.
9 min read - バイブコーディングセキュリティSupabaseデータベース個人開発
What is Supabase "RLS"? — how AI-built apps end up with all their data public, explained without code
"ChatGPT told me to enable RLS but I don't know what that means." This explains what Row Level Security is, and why without it every user's data is readable by anyone — no code reading required. Includes how to check your own project and an instruction to paste into your AI tool.
8 min read