GuidesAI-Built Apps
Is an AI-Built App Safe to Launch?
An AI-built app is not safe to launch because the happy path worked for you. Before a customer uses it, a second account must be unable to read the first account's data, every sensitive action must be checked on the server, and no API key or database password may live in the browser. A 2026 study of 200 publicly deployed vibe-coded apps found at least one vulnerability in 91 percent of them, most often broken access control, injection, and authentication failures.
What the public research shows
A 2026 paper, Understanding the (In)Security of Vibe-Coded Applications, audited 200 publicly deployed apps built with AI coding agents. The authors report that 91 percent had at least one vulnerability, and that about two thirds of the vulnerabilities they identified were critical or high. The common clusters were broken access control, injection, and authentication failures. The paper is at https://arxiv.org/html/2606.23130v4. It describes other people's apps. It is not a claim about a project I have personally repaired.
The pattern matches what shows up when a tool writes the first version quickly. The screen looks finished. The rule that should protect a row of data was never written, or it was written in the browser where the user can ignore it.
Checks you can do without being a developer
- Open a private browser window and try a page that should require sign-in. If it loads, the page is public.
- Create two accounts. In the second account, try to open a record, file, or URL that belongs to the first. If you can, stop the launch.
- Search the project for the words key, secret, password, and service_role. A key in a file that ships to the browser is a leak.
- Turn the network off and click the main button. If the only result is a blank screen, a customer will see that too.
- Deploy it once, then ask someone else to do the main task on the deployed URL, not on your laptop.
| Check | Pass | Stop |
|---|---|---|
| Signed-out visit to an inner page | The page asks for login | The data is visible |
| Second account opens the first account's record | The server says no | The record opens |
| API key location | Only on the server | In the front-end code or a public repo |
| A bad input, such as an empty form | A clear error | A crash or a half-written row |
If a check fails
Do not ask the same AI tool to "make it secure" in one prompt and then launch. That prompt often adds a password field and leaves the database rule unchanged. Send the failing check, the URL, and what you expected to happen. Hourly work is $35. If the list of failures is already clear, I will turn it into a fixed quote before the repair continues.
Questions this page answers
Is that 91 percent figure from my clients?
No. It is from a published study of other people's publicly deployed vibe-coded apps, not from projects I have shipped. The useful part is the pattern: access control, injection, and login failures showed up again and again.
Does hiding the admin button make the app safe?
No. Anyone can request the admin address or the API directly. The server has to refuse the action for a user who is not allowed to take it.
What if the app has no user accounts?
The bar is lower, and it is still not zero. A public form that writes to your database, sends email, or calls a paid API can be abused. Rate limits, validation, and a secret that is not in the page still matter.
Keep going
Want this applied to your workflow?
Hourly work is $35. A fixed fee is a custom quote after we define the scope.