My AI Pair Programmer Shipped a Whole App in a Week — Then I Read the Code

Let me get the obvious out of the way: AI coding assistants are fast. Scary fast. I built a functional expense-splitting web app — the classic 'I owe you dinner money' tool — in about five evenings using nothing but GitHub Copilot and Cursor. No Stack Overflow tabs. No begging on forums. Just me, an editor, and a very confident autocomplete.

The app works. My friends actually use it. And yet I've spent the last week quietly fixing things that would've never made it past day one if I'd written the code myself.

The Honeymoon Phase Is Real

The first two days felt like a cheat code. I'd type a comment like "// validate the uploaded receipt" and watch a fully-formed function appear before I finished my coffee. If you've ever spent an afternoon wrestling with a date-parsing edge case, the feeling of that problem simply vanishing is hard to overstate.

Cursor's whole-project awareness was the standout. It suggested refactors across files, kept my naming conventions consistent-ish, and wrote boilerplate I genuinely dreaded. For scaffolding, config files, and test fixtures, the speed was absolutely worth it.

Then came day three, and the bill started coming due.

Bug #1: The API Key That Lived in Plain Sight

The assistant helpfully hard-coded a fallback API key into a config file — presumably because somewhere in its training data, that's what demos do. It wasn't a real key, but the pattern was there: secrets in source, ready to be committed. I caught it because I reviewed every diff. I'm not confident everyone would.

This is the dirty secret of AI-assisted coding: the model doesn't know your security posture. It knows what code usually looks like, and usually-look code has plenty of console.log statements, weak error handling, and "temporary" solutions that became permanent in someone else's repo a decade ago.

Bug #2: The Same Function, Four Times

By day five, my codebase had four nearly identical functions for formatting currency. One rounded incorrectly. One crashed on negative numbers. Each had been generated in a different file because the assistant didn't remember it had already solved — badly — the same problem elsewhere.

Human developers do this too, but a human teammate would've gotten shamed in code review by week's end. The AI has no shame. Duplicate logic doesn't bother it. Only you can notice, and only if you're looking.

Bug #3: Code I Couldn't Explain

The most unsettling moment came when a friend asked why the app handled timezones a certain way. I opened the file, read the function the AI had written, and realized I had no idea. It worked. I could describe what it did. But why it was structured that way — the reasoning — was gone. I'd accepted the suggestion, moved on, and outsourced my own understanding.

That's the real debt. Not the bugs, which are fixable. It's shipping software you can't defend, debug, or modify with confidence. Technical debt is usually framed as bad code. This is worse: it's unowned code.

The Frank Ledger

Here's my honest accounting of when AI assistance paid off:

Worth it: Boilerplate, test scaffolding, CSS I'd otherwise rage-quit on, regex (always regex), and the first 20% of any new project when momentum matters most.

Not worth it: Authentication flows, anything touching money or personal data, architectural decisions, and honestly, the code you'll need to maintain for years. The time you save writing it, you'll spend triple deciphering it.

What I'd Tell a Friend

Treat AI assistants like an eager junior developer who read the entire internet but has never shipped to production. Their code needs review — real, line-by-line, skeptical review — the same as anyone's. The speed is real, but so is the bill.

My expense app works, and I'm keeping it. But next project, I'm writing the security-critical parts myself. Some shortcuts aren't shortcuts; they're just deferred work with interest.