Somewhere in the last six months you typed a prompt, got back a working Laravel app with login, a dashboard, and a database, and showed it to a few customers. They liked it. Now they want to pay for it, and "it works on my machine" stops being a deployment strategy.
This article is a practical checklist for turning an AI-generated Laravel prototype into something you can confidently run in production. Nothing here assumes the code is bad; it assumes it's unreviewed — true of any code nobody has audited, no matter how it was written.
The prototype was the easy part
A prototype's job is to prove an idea. Production's job is to survive real users: their data, their edge cases, their mistakes, and the security researchers who poke at anything that looks popular. The gap between those two jobs isn't about "AI bad, humans good" — it's about process. Code generated in minutes skipped the review loops that code written slowly accumulates. Your job now is to add those loops, not to be ashamed of what you have.
Start with an audit, not a rewrite
The single most expensive mistake teams make at this stage is deciding to rewrite from scratch. Before you can decide anything, you need to know what the app actually does. Spend a few days auditing:
Run the whole app and exercise every feature. Make a feature list from the UI, not from the prompts you typed. What exists and what was hallucinated or left as a stub?
Map the surface.
php artisan route:listshows every route; check that each one is intended and no debug or demo routes are exposed.Inventory dependencies.
composer showandnpm listtell you what is installed. Flag anything you don't recognize.Read the migrations as the story of the data model, and the database itself — sample rows in
users, look for test data that must not ship.Look for secrets. Search the repo for keys, tokens, and credentials (
rg -i "password|secret|api_key|sk-" .is a good start) — anything committed is compromised and must be rotated.
A good audit ends with a written list: "here's what the app does, here's what it depends on, here's what scares us, here's what's fine." That document is your roadmap.
Architecture: how the code is actually organized
AI assistants love to put everything in a couple of fat controllers — or worse, business logic inside Blade views. Laravel's conventions exist because they're boring and predictable: models for data, controllers for HTTP, Form Requests for validation, services or actions for business logic when a controller gets heavy, and policies for authorization.
You don't need to gold-plate, but the code should follow the framework's defaults closely enough that any Laravel developer — including future-you — can find things and change them without fear. Look for:
Business logic in
routes/web.phpor Blade templates.Controllers with hundreds of lines doing everything (validation, auth, database writes, emails).
Migrations that drop or recreate tables that later migrations depend on.
Models with no
$fillable/$guarded(a mass-assignment accident waiting to happen).The application structuredocumented by Laravel is the target; refactor toward it incrementally, one domain at a time, not in one heroic weekend.
Dependencies and licensing
A prototype installs packages freely; a product has to live with them, so check every one now:
Composer audit.
composer auditchecks your dependencies against known security advisories; run it and read the output. Same for the npm side withnpm audit.Abandoned packages.
composer showflags abandoned packages. If your prototype depends on one, plan a replacement before it breaks your upgrade path.Licenses. If the product is commercial, check the license of every package that ships in the product (MIT/BSD are usually fine; copyleft licenses like GPL/AGPL can impose obligations you did not intend). Also check commercial packages: are you entitled to use them in a paid product, or only in prototypes?
Versions. Pin versions sensibly in
composer.json/package.jsonand plan a regular update cadence — a prototype that never updates becomes a production system with known, public vulnerabilities.
Security, authentication, and authorization
This is where unreviewed code is most dangerous — and where Laravel helps most if you use what ships in the box:
Authentication. Use the framework's authenticationsystem or a starter kit (Breeze/Fortify). If the prototype rolled its own login, replace it — custom session and password code is a classic source of real vulnerabilities.
Authorization. Every route that acts on another user's data needs a check. Laravel policies and gatesare the idiomatic way; if the prototype lets user A edit user B's records, that's the bug customers will find.
Mass assignment. Confirm every model defines
$fillableor$guarded, or requests can slip fields into your database.Input validation. Validate in Form Requests, not inline in controllers; the validation docs cover the rules you'll need.
Environment and keys.
APP_KEYmust be set and unique;.envmust not be in git; production keys must differ from dev keys. Force HTTPS in production.The rest. Run through the Laravel security guide, especially CSRF, XSS (use
{{ }}/Blade escaping and the Vue equivalents), and SQL injection in any raw queries the prototype might have used.
None of this is exotic. It's the same checklist any experienced Laravel developer applies to human-written code; AI code just means you're the first human reviewer.
Data model and migrations
Prototype migrations are usually "make it work fast": missing indexes, no foreign keys, inconsistent timestamps, enums stored as plain strings, and sometimes a migrate:fresh habit baked into the workflow. Production cares about all of these:
Indexes on columns used in
WHERE,JOIN, andORDER BY— the migrations and database query docs show how to declare them properly.Foreign keys so the database enforces integrity instead of hoping the code does.
A fresh-start test: delete the database, run
php artisan migratefrom zero, and confirm it works. If your migrations only work because of manual tweaks you did months ago, that's a deployment landmine.Soft deletes or polymorphism used as shortcuts: audit whether they're the right design before inheriting their complexity forever.
Testing
An AI-generated prototype typically has zero tests. You don't need to write 3,000 of them before launch; you need tests on the paths that would end the company:
Authentication and registration.
Payment flows (if money is involved, this is non-negotiable).
The core workflow — whatever the app's one job is.
Authorization: user B cannot touch user A's data.
Laravel's testing docs and Pest (or PHPUnit) make this surprisingly fast, especially with factories. The rule: anything you'd be embarrassed to break in front of a customer gets a test, and CI runs it on every pull request.
Performance
Prototypes handle one user; products handle many, and the first thing that collapses is almost always the database query layer — most often N+1 queries, fetching a list then querying per row in a loop. Run the app with Laravel Telescope or a query logger on staging and look for:
N+1s, fixed with eager loading (
with()) — see the Eloquent docs.Missing indexes on hot queries.
Synchronous work that belongs in the queue(emails, exports, webhooks).
Large lists rendering without pagination.
Repeated heavy queries that should be cached.
Do the obvious fixes first — most prototype performance problems are the same handful, and they're all cheap to fix.
Observability
You cannot debug what you cannot see. Before launch you want at least:
Structured logs in production (logging docs), not just
dd()calls.Error tracking — Laravel's built-in error pages are for development; production needs real exception reporting: Nightwatch, Sentry, Flare, or similar.
Telescope (or similar) on staging, so you can see requests, queries, jobs, and mail before users do.
CI and deployment
Two things make "we can deploy safely" true: automated checks and reproducible deploys.
CI: on every push, run Pint (
vendor/bin/pint --test), a static analysis pass (Larastan/PHPStan are the common choices), and the test suite. Fail the build on red.Deployment: deploy from a git branch through a real pipeline — Laravel Forge or Laravel Cloud, or GitHub Actions against your own server. The deployment docs cover the standard sequence: install dependencies, build assets, run migrations with a deployment hook, restart queue workers.
Is Laravel Cloud a fit?
Laravel Cloud is a reasonable default for a small product with no ops team: it handles servers, TLS, managed queues, databases, and scheduled tasks, and its deployments follow Laravel's own build sequence. It's a weaker fit if you need exotic system packages, long-running custom daemons, or deep server-level access. Either way, decide deliberately — see our separate guide on moving from Forge to Laravel Cloud.
A realistic timeline and the honest risks
Realistic numbers, no sales pressure: a small app (a few models, auth, a handful of features) can typically be audited, hardened, tested, and deployed in one to two weeks of focused work. A larger prototype with payment flows, many integrations, and thousands of lines of unreviewed code is usually four to eight weeks. The audit findings decide it — not the size of the original prompt.
The honest risks, named plainly:
Unknown behavior. AI code sometimes does things nobody asked for. This is why the audit comes first.
Committed secrets. If credentials were pushed to a repo, assume they're public and rotate everything.
Data loss during schema changes — which is why backups and tested migrations come before "improvements."
Scope creep. "While we're at it, let's also redesign the dashboard" is how two weeks becomes six months. Freeze scope; the redesign is a separate project.
Nobody said "no guarantees" out loud. No one can honestly promise a migration is risk-free or that production will never have an incident. The goal is a process where incidents are recoverable.
Where Coding Wisely comes in
If this checklist feels like a lot — it is. That's the real cost of the distance between prototype and product, and it's the same cost human-written code pays, just compressed. The Coding Wisely team works with founders and small teams who built on AI-generated Laravel and now need it production-grade: we run the audit with you, fix the security and data issues first, get tests and CI in place, and hand you back an app you can deploy with confidence — plus a maintenance habit you can keep. Tell us where you are and we'll tell you honestly what the gap looks like. Start the conversation.
Frequently Asked Questions
Do we have to rewrite the app from scratch?No — and starting from scratch is usually the worst option. AI prototypes typically contain the right skeleton and much working logic. An audit determines what to keep, what to refactor, and what to replace; rewrites throw away working code and reintroduce bugs you already fixed.
How long does this take?For a small app, one to two weeks of focused work; for larger prototypes with payments and many integrations, four to eight weeks. The audit defines the scope — ask us for a concrete estimate before any work starts.
Is AI-generated Laravel code secure?It's not inherently insecure, and it's not inherently safe either. It's unreviewed. The security risks (mass assignment, weak authorization, committed secrets, missing validation) are the same ones found in any code that shipped without review. A security audit catches them.
What about package licensing — do we need a lawyer?For most small products, a careful pass through the dependency list with Composer's license metadata is enough to catch the common problems (copyleft packages in commercial products, commercial packages used beyond their terms). If licensing matters to your company, have counsel confirm.
Can we keep using AI tools after this is done?Absolutely — and most teams do. The point of hardening is that AI-generated changes land in a codebase with tests, CI, and review, so the AI stays a tool instead of becoming a liability.
