Quick Answer
AI tools write working code, but research shows nearly half of it ships with security holes. Before you go live, run this 10-step check: get your secret keys out of the code, confirm nothing leaked to your public repo, lock down who can read your database, turn off public access to private data, add rate limits, validate every form, force HTTPS, set a spend cap, require login on protected pages, and run one last audit. It takes about ten minutes and catches the leaks before strangers do.
If you built your app with Lovable, Bolt, Cursor, or Claude Code and you skipped the security check, here is what can happen. A stranger finds your secret key in plain sight. They run up your bill overnight. Or they open your database and read every user's private data.
This is not a scare story. It is the most common way AI-built apps break.
Why AI-Built Apps Ship With Security Holes
Your AI assistant is brilliant at making code that works. It is not as careful about making code that is safe. Those are two different things.
Veracode tested over 100 AI models across 80 coding tasks in 2025. When the AI had to choose between a safe way and an unsafe way to write something, it picked the unsafe way 45% of the time (Veracode 2025 GenAI Code Security Report). Worse, that number has not improved as the models got smarter.
Definition
Building an app by describing what you want to an AI tool, instead of writing the code by hand. It is fast and powerful. But the AI rarely adds security unless you ask for it, one item at a time.
What It Costs When You Skip This
The damage is already showing up in the real world, on live apps people shipped in a weekend.
In October 2025, the security firm Escape scanned 5,600 public vibe-coded apps. They found over 400 exposed secrets, including API keys, and 175 cases of leaked personal data such as medical records and bank details (Escape.tech). Most of these keys were sitting in plain view, no hacking required.
One popular building tool, Lovable, left users' source code and database passwords open for 48 days through a single flaw (TheNextWeb). A separate Lovable-built app exposed 18,000 people's personal data because the AI let any visitor read the whole database.
Definition
A secret password that lets your app talk to a paid service like OpenAI or Stripe. If a stranger gets it, they can spend your money or act as you. It must never sit inside code that the public can see.
The good news: you do not need a computer science degree to avoid this. You need a checklist.
The 10-Step Pre-Deploy Security Check
Run these before you press Deploy. Every step is something you check in your tool's settings or dashboard. No code. No terminal.
| # | Check | What you are looking for |
|---|---|---|
| 1 | Secret keys are hidden | Keys live in your tool's secrets settings, not pasted into the app |
| 2 | Nothing leaked to your repo | No keys or passwords saved in your public GitHub project |
| 3 | Database is locked down | Logged-in users can only see their own data, not everyone's |
| 4 | Private data is private | Anything sensitive is switched off from public access |
| 5 | Rate limits are on | One bot cannot hammer your app or drain your budget |
| 6 | Inputs are checked | Forms reject junk and never blindly trust what users type |
| 7 | HTTPS is forced | Every page shows the padlock, always |
| 8 | Spend cap is set | Every paid service has a hard monthly limit |
| 9 | Login actually works | Protected pages stay locked when you test them logged out |
| 10 | Final audit done | One last pass before you go live |
A few of these deserve a plain-English note.
Locking down your database means setting who can read what. By default, AI often writes a rule that says "if someone is logged in, let them see everything." That means any user can read every other user's data. You want each person to see only their own.
Rate limits put a ceiling on how many times someone can hit your app per minute. Without one, a single bot loop on a viral day can empty your billing account before morning.
Spend caps are your safety net. Set a hard limit on every paid AI or payment service. If something goes wrong, the bill stops instead of climbing.
You Do Not Have to Check This By Hand
Here is the honest part. Going through ten checks across five different dashboards is tedious, and it is easy to miss one. The riskiest gaps are the ones you cannot see because you do not know to look.
So we built the check into a tool that does it for you. It is a drop-in skill for Claude Code. You add it to your project, run one command, and it walks your whole app against this exact checklist. It reports each item in plain English: safe, not safe, or check this yourself. Under a minute, no security knowledge required.
Key Takeaways
- AI picks the insecure coding option 45% of the time, and that has not improved over time.
- A scan of 5,600 vibe-coded apps found 400+ exposed secrets and 175 personal-data leaks.
- The most common leak is a secret key sitting in plain view, spendable by anyone who finds it.
- The fix is a 10-step check in your tool settings, not a code rewrite. It takes about ten minutes.
- You can hand the whole audit to a drop-in skill that runs it for you in under a minute.
Your Next Step
Your AI built it. Now make sure it survives the internet. Run the 10-step check before your next deploy, and never ship a leaking app again.
Want the audit done for you? Get the Pre-Deploy Security Audit skill — it runs this whole checklist automatically and reports in plain language.
Read Next
- GDPR + AI in 2026: The 12-Point Checklist
- The Best AI Coding Assistant for Non-Developers
- Build a $10K Website Free With Claude Code
- How AI Builds Your Passive Income While You Sleep
- One Creator, Five AI Agents: The Content Pipeline
Frequently Asked Questions
No. AI-generated code is usually functional, but functional and safe are different things. Veracode's 2025 study of over 100 AI models found that when given a choice, the AI wrote insecure code 45% of the time, and that rate has not improved as models advanced. AI tools rarely add security on their own unless you ask for each protection by name. That is why a quick pre-deploy security audit matters. You are not fixing the AI's work line by line. You are checking the handful of settings that decide whether your app leaks.