Vibe-coded MVP: what to check before inviting real users

A working demo answers whether an idea can be shown. A production MVP must also answer whether a customer can complete one useful task safely and reliably. Keep the first release focused on that task; postpone features that do not help test the buying decision.

1. 01

   Start with access control. Create two test accounts and verify that neither can read or edit the other account’s records, including by changing an identifier in an API request. Keep service credentials on the server. Review database rules and every endpoint that accepts user input; a hidden button is not an access restriction.

2. 02

   Test the complete customer journey with realistic failures. Try an expired login, a slow connection, a duplicate submission and an unavailable external service. For paid products, verify payment status on the server and process repeated webhook deliveries without creating duplicate orders. Show a recoverable state when a dependency fails.

3. 03

   Set up error reporting, a backup and a rollback procedure before the first invitation. Actually restore a test backup. Record which release introduced a failure so that an incident can be connected to a specific change. AI-generated code needs the same operational checks as manually written code.

4. 04

   Define one activation event: for example, a customer creates and shares a usable report. Measure the path from landing page to signup to that event, then to an enquiry or purchase. Page views alone cannot show whether the product solves a problem.

5. 05

   A useful handover contains the repository, environment-variable inventory without secret values, deployment instructions, ownership of third-party accounts and a list of known limitations. Ask a second person to follow the instructions. If they cannot deploy and recover the product, the handover is incomplete.