AI built the leasing app in two weeks. Here's what the next three took.

WareSpace provides small warehouse spaces, all-inclusive, for businesses that are too big for garages and too smart for traditional warehouse leases. It runs more than 30 buildings now. In June, a two-person team on the business side built a leasing app with AI coding tools in about two weeks: Stripe deposits, tenant personal data, and postings straight into the accounting system. The first building was going live in under three weeks, and nobody outside that team had read the code.

The problem

What I was looking for was just someone to make sure PII was secure, that we didn’t have any glaring security vulnerabilities in our code and database, and to make sure the app wouldn’t break when being used in real life.

— Eric Golman, CMO, WareSpace

That was the ask. Underneath it sat the question you ask of any software a business is about to run on: does it change in a controlled way? Is a change reviewed before it reaches production? Does anything verify it? Are the live credentials somewhere one laptop can’t walk off with? Before a charge lands in the books, does something check that it’s right? This app was going to be the foundation the buildings operated on. Two people building at speed had produced a good one, with no development process around it yet. The 48-hour audit had to answer the ask and the question underneath it.

What the audit found

The app itself was sound: Low risk, 0 Critical, personal data encrypted, every tenant able to see only their own records, the payment flow tested. What was missing was the scaffolding around it: the process a team uses to change software safely.

They were the pieces every app built this fast is missing before a team forms around it: nowhere to try a change before tenants saw it, nothing that told anyone when something broke, the person writing a change also being the one approving it, and a payment flow that worked when everything went right but hadn’t yet been built to survive a failure halfway through. The risk wasn’t the code, and it wasn’t the pace. It was moving at 16 changes a day without the guardrails that make that pace safe.

The other gap was inside the features themselves. AI will build a payment flow as fast as you can describe one. It won’t decide, unprompted, that a charge must never run twice, that a lease doesn’t count as signed until the document is safely stored, or that a write to the books has to survive a timeout. Those are judgment calls, and they come from having seen what happens without them. Someone has to make them and steer the tool accordingly.

What I did

Inside the 48 hours I closed the one finding that touched personal data and recommended launching with less automation than planned: let tenants reserve and pay online, but keep a person checking every payment before it counted. The steps that touched the books were the ones that hadn’t yet been built to survive a failure, and 17 days wasn’t enough to harden them and prove it. Automating the reversible half first meant a bad day at launch cost someone an hour, not a tenant a double charge. Then I stayed on with the team to finish what the launch still needed, close out the findings, and keep watch once it was live. Over three weeks that meant shipping: e-signature for the lease itself, with a guard so it can’t be marked signed until the signed document is safely stored; error tracking, so someone hears about a failure before a tenant does; background work that finishes even when a step fails partway; automated checks that run on every change before it goes live; and protection on the public deposit page so a script can’t flood it with fake reservations.

Speed was the asset, so the fix couldn’t be “slow down.” I put a review loop on every change instead: I sorted each one by whether it touched money, tenant data, or the books, checked it, and nothing counted as reviewed until the blockers behind it were fixed. Before launch it caught a path where a tenant could be charged twice and a promo code that applied itself when its check errored. I fixed the first; the team fixed the second the same week. By launch the app had 551 automated tests, up from 36.

What runs on it now

Plano went live on July 6, 17 days after the audit. Park Hill, in Denver, followed on July 20. A tenant now reserves, signs, and pays from their own phone in under five minutes; the old process took 20 to 25 minutes in a manager’s office.

The 48-hour audit became a standing engagement. I’m still the engineering lead on the leasing app, and the same review loop and working sessions now cover product direction, the roadmap, and the other tools WareSpace is building on the same foundation.

He turned out to be a true strategic partner who not only brought proper DevOps to that app and every other project we are working on at WareSpace, but also helped define the product direction, scope, roadmap, etc. through consultative working sessions. It’s rare to find an engineer with deep technical knowledge, strong business acumen, and who also speaks “human” to communicate with non-technical stakeholders.

— Eric Golman, CMO, WareSpace

If you’ve vibe-coded something real

AI gets you the first 90% in days. The rest is the guardrails around the code and the judgment inside it, and that was always the expensive part. An audit is where you find out which of those you already have.