Links, prompts and checklist

Shipping secure
AI-generated code

For anyone shipping apps and services built with Lovable, Bolt, Replit, Cursor, Claude Code, Codex or ChatGPT.

How an app works

Front end

The website or phone app. Anyone can read everything sent to it.

Back end

Your server. It decides who is allowed to do what.

Database

Every user's records, stored together.

Other services

Payments, AI, email. Each needs a secret key.

You log in on your phone. The app talks to the server, the server reads the database, and calls other services with its keys.

Our example: Sam builds an expense tracker with AI in an afternoon. Alice and Bob sign up and log their spending.

"It works" and "it's safe" are different questions.

What the demo shows

Alice signs up, adds a £42 lunch and sees her dashboard. Every button works.

What the demo hides

Bob changes one word in a web address and sees Alice's spending. A stranger finds the AI key and runs up the bill.

Working asks "can I do this?"
Safe asks "who else can do this?"

When AI-built apps leak

  • Mar 2025

    Lovable apps. 170 of 1,645 showcased apps had missing or loose database rules. Outsiders could read and write user data.

    CVE-2025-48757
  • Jul 2025

    Base44. A flaw let anyone register for companies' private apps using only the app's ID, which sits in the address bar.

    Wiz
  • Jul 2025

    Tea. Storage with no access rules exposed 72,000 images, including 13,000 selfies and ID photos.

    The Record
  • Jan 2026

    Moltbook. Built without writing code. The database key was in the browser and no rules were set: 1.5 million API tokens and 35,000 emails exposed.

    Wiz
  • Feb–Apr 2026

    Lovable. For eleven weeks, any Lovable user with a link could read public projects' source code and AI chat history.

    Lovable

When agents, packages and platforms go wrong

  • Jul 2025

    Replit and SaaStr. During a code freeze, an AI agent deleted a live database of over a thousand business contacts.

    Fortune
  • Aug 2025

    Nx "s1ngularity". A poisoned npm package told victims' own AI tools (Claude, Gemini, Q) to hunt for secrets. Over 2,000 GitHub accounts leaked.

    Wiz
  • Sep–Nov 2025

    Shai-Hulud. A self-spreading npm worm infected hundreds of packages and published secrets to over 25,000 GitHub repositories.

    The Register
  • Dec 2025

    Google Antigravity. Asked to clear a project cache, an agent wiped a developer's entire drive instead.

    The Register
  • Oct 2026

    Railway. Attackers reached the system holding customers' secret keys. Every customer was told to rotate them, and deploys were paused.

    GitGuardian

How often it happens

28.6M

secret keys leaked on public GitHub in 2025, up 34%. Leaked AI service keys rose 81%.

GitGuardian, 2026
45%

of AI-generated code samples contained a known security flaw from the OWASP Top 10.

Veracode, 2025
2,000+

serious flaws and 400+ exposed secrets found in 5,600 public vibe-coded apps.

Escape, 2025
5,000

vibe-coded apps found exposing company, medical or personal data, out of 380,000 public ones.

Axios, 2026
35

new vulnerabilities traced to AI-written code in March 2026 alone, up from 6 in January.

Georgia Tech, 2026
1 in 5

AI code samples used a software package that does not exist. Attackers register those names.

USENIX Security, 2025

Four things worth protecting

1

People

Their accounts and logins.

2

Data

Anything a user would not post publicly.

3

Keys

The passwords your app uses for other services.

4

Money

AI calls, emails and storage cost money per use.

For each one: who should reach it, and what stops everyone else?

1If the browser gets a key, so does everyone.

What a visitor sees in the app's files 

    

  

  
Keep private keys on the server. Give each one only the access it needs, a spend limit and an expiry date.

  
For developers: NEXT_PUBLIC_, VITE_ and EXPO_PUBLIC_ variables ship to the browser. Leaked? Rotate first.







  
2Logged in does not mean allowed.

  

    
Who are you?
Authentication. Bob proved he is Bob.

    
What may you see?
Authorisation. Bob may see Bob's data, and only Bob's.

  

  

    

      Bob is logged in
      
    

    

      
      
    

    
Pick a request.

  

  
For developers: broken object-level authorisation, number one on the OWASP API Top 10. Take the user from the verified session, never from the request.







  
3Your database needs its own rules.

  

    

      
With Supabase or Firebase, the app talks to the database straight from the browser. The database rules are the only lock.

      
-- Supabase: Row Level Security
alter table expenses enable row level security;
create policy "own rows only" on expenses
  for select to authenticated
  using ((select auth.uid()) = user_id);

    

    

      

        Bob loads the expenses table
        
      

      

        
owneritemamount

        
          
aliceRent share£380

          
aliceLunch£42

          
bobTrain£96

          
bobGroceries£84

        
      

      
      
Rules are off. Run the request.

    

  

  
For developers: one policy per operation, check grants to anon, and remember views, security definer functions and the service-role key bypass RLS.







  
4Everything a user sends can be faked.

  

    
Text that becomes code
A "name" field holding commands for your database, or a script for other people's browsers.

    
Files that lie
"invoice.pdf" that is really a web page with a script, or a 4 GB upload.

    
Prices and roles
A checkout that sends "price: £0.01", or a sign-up that adds "role: admin".

  

  

  
Check it on the server, every time, even if the form already did.

  
For developers: parameterised queries, schema validation at the boundary (Zod, Pydantic), output escaping, upload type and size limits.







  
5Every free button is a bill someone else can run up.

  

    

      
Without limits

      
A bot presses your "summarise with AI" button 50,000 times overnight, or signs up 10,000 fake accounts that each get an email. You find out from the invoice.

    

    

      
With limits

      
    
        
  • Spend caps on every AI and email provider
    • 
        
  • Rate limits per person
    • 
        
  • Bot checks on sign-up and login
    • 
        
  • Alerts when usage jumps
    • 
      

    

  

  

  
Set a monthly spend limit on your AI account tonight. It takes two minutes.







  
6Give your AI agent intern access, not admin.

  

    
Separate test from real
The agent builds against a copy. Live data stays out of reach, and backups are tested.

    
Check what it installs
AI invents package names, and attackers publish malware under them. Skills, plugins and MCP servers are code too.

    
Watch what it reads
A web page or document can hide instructions for your agent. This is prompt injection.

  

  

  
Ask: if this agent did the worst thing it could with its current access, what would I lose?







  
More to check before launch

  
    
    
  • Admin pages and staging sites open to anyonePut them behind a login.
    • 
    
  • Payment webhooks that are not verifiedAnyone can fake "payment succeeded".
    • 
    
  • Error pages that show code or dataTurn off debug mode in production.
    • 
    
  • File storage set to publicUploads, ID photos and invoices.
    • 
    
  • Password reset links that never expireOr can be reused.
    • 
    
  • Logs that record passwords or keysLogs get shared and leaked too.
    • 
    
  • Any website allowed to call your APICheck the CORS settings.
    • 
    
  • Old packages with known holesUpdate them, or let a bot do it.
    • 
  

  
Explanations and fixes for each are in the links page.







  
You don't have to build this yourself

  

    

      
Sign-in

      
Passwords, magic links, Google sign-in, resets.

      
Clerk · Supabase Auth · Firebase Auth · Auth0 · Kinde · Better Auth

    

    

      
Database rules

      
Each user sees only their own rows.

      
Supabase RLS · Firebase Rules · Neon RLS

    

    

      
Keeping keys secret

      
Keys live in your host's settings, not the code.

      
Vercel · Netlify · Railway · Cloudflare · Doppler · Infisical

    

    

      
Payments

      
Hosted checkout: card numbers never touch your app.

      
Stripe Checkout · Paddle · Lemon Squeezy

    

    

      
Bots and limits

      
Stop fake sign-ups and runaway usage.

      
Turnstile · hCaptcha · Upstash rate limit

    

    

      
Knowing when it breaks

      
Errors and odd usage reach you first.

      
Sentry · PostHog · Better Stack · Datadog

    

  

  
Tip: name the service in your prompt. "Use Clerk for sign-in and Stripe Checkout for payments" gets far safer code than "add login and payments".







  
Cloudflare features most people never switch on

  

    
Access
Put admin and staging pages behind a login without writing code. Free for up to 50 users.
Docs

    
AI Gateway
Route AI calls through it to set dollar spend limits, rate limits and caching.
Docs

    
Turnstile
A free bot check for forms, without the picture puzzles.
Docs

    
Rate limiting
Cap how often anyone can hit login, sign-up or your AI endpoints.
Docs

    
Bot Fight Mode
One switch that challenges known bad bots.
Docs

    
WAF managed rules
Ready-made rules that block common attacks before they reach your app.
Docs

  







  
Keep your code safe

  

    

      
Switch on in GitHub

      
    

    

      
Free and open-source scanners

      
    

  

  
Stars as of November 2026.







  
Use AI to review AI

  

    

      
Built-in reviewers

      
    

    

      
Security skills

      
    

    

      
Check add-ons before installing

      
      
NVIDIA found problems in 26% of 31,000 public skills.

    

  

  
A finding is a lead. A clean report is not a guarantee.







  
Find it. Fix it. Prove it.

  

    

      

        
        
        
      

      
    

    

    

  

  
"The AI says it's fixed" is step two. Step three is a test that tries the forbidden thing.







  
Three things to say to your AI

  

    

      
Before you build

      
"List what data is private and who must be refused access to it. Use managed sign-in and database rules, and keep every secret key on the server."

    

    

      
Before you launch

      
"Review this app as an attacker. Can one user see another's data? Is any secret in the browser? Show each problem and a test that proves the fix."

    

    

      
Before it runs commands

      
"Never touch the live database. Show me any command that deletes, migrates or deploys, and wait for my approval."

    

  

  

  
Longer, copyable versions are in the links page.







  
The five-minute check

  

    
    
    
    
    
    
    
    
    
    
    
  

  
0 of 11 checked







  
Before you go

  

    
Tonight
Turn on 2FA for GitHub and every account your app depends on. Set spend limits. Try to see one account's data from another.

    
This week
Turn on database rules, push protection and Dependabot. Run the "before you launch" prompt.

    
Every release
Run the five-minute check. Keep the AI away from live data.

  

  

    
AI changes who can build software.
It doesn't change who is responsible for it.

    

      
      
Scan for every link, prompt and the checklist

      
Open every link, prompt and the checklist