I ran launch audits on 20 AI-built apps, Lovable, Bolt, v0, a couple of Cursor builds. Same checks on each, run against the live deployed URL, not the code. These were the most common problems:
14/20 had a canonical tag pointing at the wrong domain. Usually the builder's preview URL. The site works fine on the custom domain, but it's telling Google the real version lives at something.lovable.app.
Your domain never ranks and you'd never know why.
12/20 had broken or missing basic SEO. No meta description, no OG image (so every shared link is a grey rectangle), or a sitemap listing pages that 404.
9/20 had analytics installed but not firing. Added early, then the AI rewrote the layout and dropped the snippet, or it fires on the homepage and nowhere else. Traffic arrives, you learn nothing.
7/20 had no way for anyone to contact them. No email, no form, nothing. Someone wants to pay you and can't tell you.
5/20 had an open database. Row level security off, so the anon key that ships in the bundle can read whatever it wants. This is the scary one and it takes 30 seconds to check.
2/20 had an actual secret key in the client bundle. Pasted in at 2am to make something work, then shipped to every visitor's browser.
And the one that applied to all 20: nothing was watching any of this.
Every prompt is a redeploy, and any redeploy can reintroduce all of the above.
Your app doesn't email you when its meta description disappears.
None of these are exotic. The AI tools are judged on whether the app runs, so that's what they're good at. Nobody's judging what a real browser actually loads at your real domain, and that gap is where launches die quietly.
I found all of this with a tool I'm building called Actuant (https://www.actuant.dev), it audits your deployed app in a cloud browser and watches it after you ship.
Join the waitlist (https://www.actuant.dev/early-access) if you want it on your app.