Koinevo and Branfam: Getting Two AI-Built Apps Ready for Users and Payments
How I took two AI-built apps and put them through the process that makes software safe to launch: an audit, a ranked plan, tests, and deploys I verify myself.
At a glance
Koinevo and Branfam are two of my own products. Koinevo is a platform that gives churches and ministries their own branded mobile apps. Branfam is a family calendar and household app. AI wrote most of the code for both, quickly. This case study is about what it took to make two AI-built apps trustworthy.
- Products
- Koinevo, a white-label church app platform, and Branfam, a family household app
- Starting point
- Large codebases written mostly by AI, with no independent review
- Process
- Audit, ranked plan, fixes in order of risk, automated tests, verified deploys
- Headline result
- Critical security holes closed within days, test coverage roughly doubled or better, live payments working
- Timeline
- June through October 2026, in focused sprints
The situation
AI can write a lot of software in a short time. Branfam’s first commit was more than 24,000 lines. Koinevo’s was more than 69,000. Both apps looked finished, and neither had been checked by anyone other than the AI that wrote it.
When I audited them, I found a wide gap between looking finished and being finished.
Koinevo had seven admin functions open to the internet, live in production with no login check. One could reset the password on any account. Another could make anyone an administrator. Koinevo also accepted requests from any website, and a private server key sat in the project folder.
Branfam had its own problems. A default secret key would have let someone forge a login outside of production. Payments were set up in name only. The payment confirmation check passed even when it should have failed, which could have handed out paid features for free. Password reset created a reset link and never sent it, so the feature was on screen and did nothing.
The AI had also made things up. Branfam’s landing page had three invented testimonials and a 4.8-star rating “from 847 reviews” for an app that had no users yet. Koinevo showed a joke video whenever a video feed failed to load. And almost nothing was tested. Koinevo had no automated tests running on changes, and Branfam’s automatic checks were broken.
That is what AI-generated software tends to look like before someone reviews it.
How I hardened the AI-built apps
Both apps went through the same process. Some of it ran through my own governed AI worker platform, where an AI engineer role performs the audit and its work is scored and recorded. More of it ran as AI sessions I directed and reviewed step by step. The rules were the same either way.
It starts with a read-only audit of the whole codebase. Nothing gets changed. The output is a list of findings, each rated by severity. From that comes a ranked plan, security first, then stability, then features, with a written definition of done for every task.
A fix isn’t done until it has automated tests and passes every check. Each app now runs its full test suite automatically before anything can be merged.
Nothing reaches users without me approving the production deploy. For Branfam’s launch, with user data already in production, that meant a database backup with a verified restore, a rollback image, and a step-by-step runbook. After each deploy I test the live system myself. I check that a forged request is rejected, that a login locks after too many attempts, and that a foreign website is blocked.
Every change also gets a written record, so the next person, human or AI, can see what was done and why.
The results
Koinevo
| Metric | Before | After |
|---|---|---|
| Admin functions open without a login | 7 | 0, fixed and verified live within 2 days |
| Backend automated tests | 68 | 199 |
| Database security rule tests | 21 | 77 |
| Admin dashboard tests | 9 | 135 |
| Automatic checks on every change | none | 4 required test suites |
| Crash reporting | none | built in, rolling out with the next app release |
The backend used to be a single file of nearly 4,000 lines. It is now split into five modules, and I checked that every function’s public interface was identical before and after the split. Writing the new admin tests also caught two bugs that had been hiding, including one that could silently lose a church’s payment settings the first time they were saved.
Branfam
| Metric | Before | After |
|---|---|---|
| Critical finding: logins that could be forged | open | fixed |
| Known vulnerabilities in third-party code | 24 | patched, and now checked on every change |
| Automated tests | 221 | 478 |
| Payment confirmation | passed when it should fail | rejects anything unsigned, verified live |
| Password reset | did nothing | works end to end |
Branfam launched publicly with working subscription billing, and a paid purchase went through from checkout to bank deposit. Within two weeks of launch, bots found the open signup page. I added email verification and bot protection, and moved signups back to invite-only while I tighten the gate.
What is still open
Koinevo still has a few security settings to finish in its cloud console, and its app-store pipeline is partly done. Branfam’s large core file is only partly broken up, and its iOS app is being resubmitted after an App Store review. Each of those is written down, ranked, and waiting its turn.
What I’d tell anyone shipping AI-built apps
The speed is fine. The trouble starts when nobody independent reads the code before customers and money touch it. Get an audit, fix things in order of how much harm they can do (security holes, then anything that can lose data, then features), and don’t call a feature finished until a test proves it works. A button on a screen doesn’t prove anything.
Built an app with AI that you are not sure you can trust?
I review and harden software built with AI tools. That means a full audit, a ranked list of what to fix, and the fixes themselves, with tests and verified deploys. If you have an app that works in a demo but you aren’t sure it’s ready for paying users, let’s talk.