Why AI-built apps leak
AI tools build what you ask for, and you usually ask for features, not protection. The result often works perfectly for honest users and lets anyone else read or change data they shouldn't.
None of these checks needs a security expert. Go through them before you share your link with anyone.
The checklist
- Secret keys: search your code for API keys and passwords. Anything the browser loads can be read by anyone, so secret keys belong in your host's environment variables and server code only.
- Database rules: if you use Supabase, turn on row-level security for every table. If you use Firebase, check your security rules aren't left open. Then sign in as one user and try to load another user's data.
- Server checks: hiding a button isn't protection. Every action that reads or changes data needs a check on the server that the person is signed in and allowed to do it.
- Admin pages: sign in as a normal user and type the address of your admin pages directly. You should be refused.
- Uploads: limit the file types and sizes people can upload, and don't let uploads run as code.
- Personal data: only ask for what you need, and never ask testers or users for real card numbers, PINs or ID numbers before your app is ready to protect them.
- Dependencies: update your packages and remove ones you don't use. Old versions are a common way in.
Then let people try to break it
Automated scanners find some of these problems; people find the rest, like a page that shows another user's name or a form that accepts anything. Post your app on VibeYoung and ask testers to check sign-in and other users' data.
Testers on VibeYoung never enter real card, PIN or ID details, and apps that ask for them are held for review.