Auditing AI-Written Code and the Missing Internet Permission Bug

In an era where artificial intelligence heavily powers software creation, building applications as an AI-augmented solo developer has become common. From defining architecture specs to driving implementation through Claude Code and Cursor, the workflow is streamlined. However, one strict rule remains unbroken: auditing what actually ships rather than trusting what the model claims to have produced.

A specific incident turned that operational rule into a permanent habit during the closed testing phase of CoalTrack, an attendance and payroll application designed for coal-mining crews. During testing, a handful of devices failed to establish any server connection. There were no error logs, no recovery retry loops, and total silence. Every earlier build had functioned seamlessly on the developer's personal machine, and the API was fully operational.

Stock photo for illustration only, not from the actual event

Realizing that reading the source code would not solve the mystery, the developer shifted focus to inspecting the actual build artifact. By unpacking the signed application bundle, they examined the merged AndroidManifest.xml file that Google Play receives during deployment.

The android.permission.INTERNET line was completely missing. In a multi-module Flutter development environment, the manifest written by the developer is not always what ships. Plugins, build configurations, and manifest merging processes dynamically rewrite the output. An upstream change had silently dropped the internet permission from the final merged result, leaving fresh installations without cached permission grants completely isolated from the network. The developer's personal phone worked only because permission had persisted from an earlier build upgrade.