How to Check Your AI-Built App Is Secure Before Launch

To check that an AI-built app is secure before launch, test three things yourself and ask a developer about three more. Test whether one user can see another user's data, whether any secret keys are visible in the browser, and whether login and password reset behave properly. Then ask where the keys are stored, how database access is restricted, and what code is actually running in production.

Why does an AI-built app need a security check at all?#

Because "it works" and "it is safe" are different things, and AI tools are judged on the first one. An app can sign people up, show their dashboard and take payments while leaving the back door open.

In apps we have opened, the same weak spots keep turning up: weak security, failed authentication, and API keys sitting where anyone can read them. A founder does not see any of that. They see a working product.

It also happens at platform level. The Next Web reported that a flaw in the AI app platform Lovable left source code, database credentials and user records exposed for 48 days after a researcher reported it. A founder cannot fix a flaw like that, but a founder can avoid leaving their own doors open on top of it.

What can you test yourself without reading code?#

Four checks take under an hour and need no technical background.

1. The two-account test. Create two accounts with different emails. Log in as the first and note the address bar and any IDs in it. Then try to reach the second account's data, for example by changing an ID in the address or by looking at shared lists. If you can see the other person's information, stop and fix this before anything else.

2. The logged-out test. Open a private browser window without logging in and paste the address of a page that should need a login. You should be sent to the login page, not shown the content.

3. The password reset test. Request a reset, use the link, then try to use the same link again. Try a reset for an email that does not exist. The way the app responds tells you a lot about how carefully login was built.

4. The browser check. Open the app, press F12 to open the browser tools, and look at the Network tab while you use the app. Search the requests for words like "secret", "service" or "private". A secret key that shows up here is visible to every visitor.

What does the login need to get right?#

The OWASP project lists common web weaknesses, and authentication failures have their own category. Among them are weak or default passwords, missing multi-factor authentication, weak account recovery, and sessions that are not ended properly. Its prevention advice includes throttling repeated failed logins and giving the same response whether or not an account exists. The full list is in the OWASP guidance on authentication failures.

You do not need to implement any of that yourself. You need to know it exists, so you can ask whether it was handled.

What should you ask about the database?#

If your app uses Supabase, which some AI app builders connect to, the main thing to ask about is Row Level Security. According to a Supabase security guide from Bastion, a table without it lets anyone holding the public key read and write every row. The service role key bypasses those rules and must never appear in front-end code.

So ask two direct questions. Is Row Level Security switched on for every table that holds user data? Which keys are used in the browser, and are any of them the service role key? If the person cannot answer, that is the answer.

What else is easy to miss?#

AI tools often add new code without removing the old. That leaves redundant files and forgotten routes, and nobody can say which version is live. Ask for a list of what is deployed and where. Also ask who has access to the hosting account, the database and the code, and whether anyone who no longer works on the project still does.

When is a DIY check not enough?#

If the app stores personal data, takes payments, or has paying customers, a quick self-check is a starting point only. A proper review looks at the code, the database rules and the hosting setup together. If you are working out whether to review, fix or rebuild, our guides on AI-built apps cover each option, and the first post in that series explains why these apps break when real users arrive. If you would like a second pair of eyes, you can get in touch with us.