Founder guide

Is your AI-built app safe to launch? A security checklist

Last reviewed 3 November 2026

AI tools are good at making an app look finished. The parts you can’t see, like who’s allowed to read which data, are where problems tend to hide. These checks work whichever tool you used, and the first few need no coding at all.

Short answer

Check whether one user can see another user’s data, whether your database has access rules switched on, whether any secret keys are visible in your site’s code, whether payments are confirmed on the server, and whether you have backups. Fix these before you invite real customers or take payments.

Tests you can run yourself

You only need two test accounts and a browser. Use test data only, and only on your own app.

The two-account test. Create users A and B. As A, open a record of your own, such as a profile, order or document, and copy the address. Sign in as B and open it. If B can see it, you have a serious problem.
Change the number. If an address ends in something like /orders/123, try 124 while signed in. Then try /admin and other pages you’d expect to be private.
The signed-out test. Copy the address of a private page, sign out, and open it in a private window. You should be sent to sign-in, with no data showing.
Prompt your AI tool for an audit, without trusting it fully. Ask it to list every database table, who can read and change each one, and where any secret keys are used. It’s a useful start, but it’s the same tool that wrote the code, so its answers need checking. Some tools also have scanners: Lovable, for example, offers quick and deep security scans, and says they don’t replace a thorough review.
Try to break sign-up and password reset. Use a fake email address, a very long name and a reused reset link. Each should fail cleanly.

What to check with someone technical

Database access rules. On Supabase, Row Level Security should be on for every table, with rules that really limit access. On Firebase, check the security rules. Having no rules, or rules allowing everyone, is a common cause of data leaks.
Secret keys. Anything that can spend money or read all your data must stay on the server. Publishable keys are designed to be public, but secret ones aren’t. Replace any key that has been exposed, including in old code.
Checks on the server. Hiding a button doesn’t protect anything. The server has to check who’s allowed to do each action.
Payments. Confirm purchases through the payment provider’s server messages, such as webhooks. The app should never be able to just say “this user has paid”.
File uploads. Limit types and sizes, and keep private files private.
Bill protection. Add usage limits on AI features and anything else charged by use, and set spending alerts. One person running a script can create a very large bill.
Abuse limits on sign-in, password reset and forms.
Separate test and live data. Test on a copy, so a bad change can’t wipe real customers’ data.
Backups you’ve tested. Make sure you can restore one, and not just that it exists.
Outdated packages. Run a check for known security problems, and confirm that each package the AI added really exists and is the one you meant to use.
Error tracking and logs, so you’ll find out about problems before customers tell you. Keep passwords and personal data out of those logs.

Things that aren’t code

Accounts: make sure your tool, database, domain and payment accounts are in your company’s name, with two-factor sign-in on.
Code ownership: export the code to your own repository, so you’re not tied to a single tool.
Privacy: publish a privacy policy that matches what your app collects, and check what the law asks of you where your customers live.
Sensitive data: health, finance or children’s data needs a professional review before launch, whatever the app was built with.

When to bring someone in

An AI tool is fine for testing an idea. Ask a professional to look before you take payments, store personal data, or sign your first business customer. See how we make AI-built apps ready for real customers. If you’re heading for the App Store, read putting an AI-built app on the App Store as well.

Questions founders ask

Are apps built with AI tools unsafe?

Not automatically. They can be made safe, but the tools don’t always set up security correctly or point out what’s missing, so someone has to check.

Can’t I just ask the AI to make it secure?

It helps, and it’s worth doing. But the AI may report that a problem is fixed when it isn’t, so test the result yourself using the checks above and get a review before you handle real customer data.

Do I need to start again with developers?

Usually not. Often the app can be fixed and kept, which is why we start with a written audit that says what’s worth keeping.