From vibe coding to production: AI-written code, with enterprise quality gates
Everyone writes code with AI today: developers with GitHub Copilot, Claude Code or Cursor, and business users who build apps themselves. The code comes fast, but without tests, review and controls, it is not ready for production.
Zooz-tech builds CI/CD pipelines for organizations in which every change, whether written by a person or by AI, passes the same gates before it goes live: tests, security scans, human review, a test environment and controlled deployment with rollback.
Fast code, silent risk
When code is generated faster than anyone can read it, risks slip under the radar. These are the ones we see most often:
Secrets in code
API keys and passwords the AI pasted into a file, committed to Git without anyone noticing.
Libraries that should not be there
Vulnerable or outdated packages, and sometimes packages the AI "made up" that attackers have already registered under that name.
No tests
The code works in the demo, then breaks with the next change without anyone knowing.
No ownership
No one read the code before it went live, and no one can explain it when something breaks.
Shadow apps
Business users launch tools outside any IT or information security process.
Three kinds of teams, one shared need
Development teams
Working with GitHub Copilot, Claude Code, Cursor or coding agents, and looking to move faster without giving up quality.
Business users who build their own
In Power Platform or vibe coding tools, and in need of a clear path from idea to an app in production.
IT and information security managers
Who need to know what went live, who approved it and what was tested beforehand.
Seven gates between code and production
Every change passes through these gates in order. Anything that fails a blocking gate goes no further, and everything else reaches the team as an alert.
Build and automated tests
Every change is built and runs through unit and integration tests. A failing test stops the merge.
GitHub Actions · Azure Pipelines
Security scans
Secrets in code, vulnerable libraries and static code analysis, before anyone even reads the change.
Secret scanning · CodeQL · Dependabot
Quality checks
Accessibility, performance, broken links and code style, based on what is relevant to the project.
axe · Lighthouse · Linters
Human review
AI writes, a person approves. Every change comes in through a pull request with defined code owners, and no agent merges on its own.
Branch protection · CODEOWNERS
Test environment
Every change gets its own environment, so you can see it working before it reaches production.
Preview environments · Deployment slots
Controlled deployment
Release to production with approval, gradually, and with one-click rollback to the previous version.
Environments · Approvals · Rollback
Monitoring
After go-live, we track errors, performance and usage, and feed the findings back to the team.
Azure Monitor · Application Insights
Four rules for coding agents
A coding agent works fast and never tires, so it needs clear boundaries. These are the rules we set in every repository an agent works in:
Instructions for the agent
An instructions file in the repository with the project's conventions, tools and prohibitions, so the agent writes to your standard from the start.
Least-privilege permissions
A coding agent gets permission to open a pull request, not to merge or deploy to production.
Limits on external input
An agent that reads issues or web pages is exposed to malicious instructions hidden in them. We define what it may do with what it reads.
A trail for every change
You can see which changes were written with an agent, who requested them and who approved them.
GitHub, Azure DevOps or Power Platform
We build on the platform you already have. The pipeline differs in the details, but the gates are the same.
GitHub
GitHub Actions for CI/CD and GitHub Advanced Security for scanning. An especially good fit for teams that already work with GitHub Copilot.
Azure DevOps
Azure Pipelines and Repos, with GitHub Advanced Security for Azure DevOps. A good fit for organizations that manage their tasks and projects there.
Power Platform
Low-code apps move between development, test and production environments through Solutions and Pipelines in Power Platform, with approvals.
From one project to the whole organization
Assessment
We review your repositories, process and existing tools, and how the team uses AI today.
Design
We define the gates: what blocks, what only alerts, and who approves what.
Setup on one project
We build the pipeline on an active project and calibrate it against real work.
Scale-out and training
We replicate the template across your other projects and train the team to work with it.
Want to start with your team? In our AI Agents & Automation workshop, we build the rules for working with coding agents in your organization together.
The site you are reading was built this way
The Zooz-tech website was written with an AI agent and goes live automatically through GitHub Actions when a change is approved. Changes are checked with accessibility tests against WCAG 2.2, SEO and link checks, and a display check on mobile and at a width of 320 pixels.
What we check
- Automated accessibility testing (axe-core) on every page, on desktop and mobile
- Checks of all links and legacy URLs
- Checks of canonical tags, the sitemap and structured data
- Automatic deployment with GitHub Actions when a change is approved
Frequently asked questions
What is vibe coding?
Vibe coding is a term for development in which you describe to an AI model, in plain language, what you want to build, and the model writes the code. The term was coined in early 2025 and now covers both developers who work with coding agents and business users who build apps themselves.
Do we need to replace our tools?
No. We build on the GitHub or Azure DevOps setup you already have, and on the AI tools your team already works with.
Won't the checks slow the team down?
The checks run automatically on every change, and whatever passes moves on without waiting. Only what is defined as blocking stops the merge, and everything else arrives as an alert.
Does this work for Power Platform too?
Yes. Power Platform apps move between development, test and production environments through Solutions and Pipelines in Power Platform, with approvals, just like any other code.
How do you prevent secrets from leaking?
With secret scanning that blocks a change before it gets in, secrets stored in Azure Key Vault or in pipeline settings rather than in code, and immediate rotation of any secret that is exposed.
How long does it take to set up a pipeline like this?
It depends on the number of projects and your current setup. We start with one project, take it live, and expand from there.
Further reading: AI agents · AI workshops for organizations · Copilot Studio vs. Azure AI Foundry
Want to know what reaches production today without checks?
Together, we will review one of your projects and see which gates are missing.