One meme comes to mind for people new to building with AI: Person 1: What's your stack? Person 2: Claude.
I still see posts from people dealing with the consequences of a stack and deployment driven by AI, so here are some things worth knowing.
Managed services meter you on active users, storage, and data served. Those numbers, and others, decide your next invoice. I weighed offloading auth and image storage to Supabase for two of my own apps, and I am holding off until the traffic justifies the change.
Aside from metering, your application carries a dependency tree worth watching. A JavaScript or TypeScript framework can pull in hundreds of packages before you write a line of your own code. In 2025 an attacker phished one maintainer and a worm rode that tree through hundreds of npm packages. When you add a capability, you pick the core package and inherit the ones three layers down, any of which can be compromised.
Also the patching window is tighter than it used to be. The gap from a public flaw to a working exploit has fallen from roughly 700 days in 2020 to about 44 in 2025, partly because AI now reads code for holes as fast as it writes it.
Managed stacks are good. That is why they end up everywhere. But when the tool picks them, the meters, the dependencies, and the patching are on you. So understand your meters before the invoice arrives, and read what AI wired in as if you will be the one patching it, because you will be.
If you have gone back through a stack an AI tool built for you, what did you find you had signed up for?
Written by Duane Grey
AI Strategy & Implementation
Independent AI consultant helping companies cut through hype and deploy systems that produce real results.