Security for AI-built apps
AI tools turn a prompt into a working app in days. What they don't do is decide it's secure: the same gaps, open data, keys in the browser, missing access-control checks, show up whichever tool you used. Start with a free, passive snapshot of your external surface, then check the parts the outside view can't see.
The tool shipped the app. Nothing checked the security.
AI builders are brilliant at making an app work. They are not accountable for making it safe. The code compiles, the demo runs, and the same handful of issues recur: a database table left publicly readable, an API key doing more in the browser than it should, an access-control check that was never written, and the ordinary web hardening that simply got skipped. None of it stops the app from working, which is exactly why it slips through.
Working and secure are different things
An app can serve every page perfectly while leaving its data readable or a key exposed. Those don't show up as errors, so they get missed until a real user, or an attacker, works through the app by hand. The speed that makes AI building great is the same speed that skips the security step, which makes a second look more useful, not less.
The outside view can’t see this
The costliest gap: who can reach whose data
The issue that does the real damage in an AI-built app is access control inside your own code: an endpoint or page that returns another user's records because the ownership check is missing or sits in the interface rather than on the server, and data that can be written or changed without permission. None of that is visible from the outside, so no passive external scan can reach it. It needs the app and its code reviewed directly, which a full review does.
What the free Surface Check covers for your AI-built app
- HTTPS and HSTS on your custom domain, so traffic can't be silently downgraded to plain HTTP.
- Security headers (Content-Security-Policy, clickjacking protection, nosniff) on your front-end.
- Your TLS certificate's health and how soon it expires.
- Cookie flags (HttpOnly, Secure, SameSite) on any session or auth cookies you set.
- Email spoofing: SPF, DKIM and DMARC on your domain, so attackers can't send email as you.
- Exposed secrets: common API keys or tokens (such as a Supabase service_role or Stripe secret key) left in the front-end code your site serves to browsers.
See your external surface in about a minute
A free, passive snapshot with an A-to-F Surface Score and every issue scored by severity and fix effort. No sign-up. We record which domain was checked and keep anonymous result statistics; see our privacy policy.
Run the free Surface Check →Frequently asked
Does it matter which AI tool I used to build the app?
Not much for the outcome. Lovable, Bolt, v0, Replit, Cursor and others differ in how they build, but the gaps we see are the same: open data, keys in the browser, missing access-control checks and skipped hardening. We have a page for each tool if you want the specifics, but the free check and the review work the same way for all of them.
Is AI-written code less secure than hand-written code?
Not inherently, but it isn't automatically secure either. AI can produce a missing authorisation check, unsafe input handling or an exposed secret as easily as a person can, just faster. The same review any code deserves still applies.
My app works, so why check it?
Working and secure are different. An app can run perfectly while leaving its database readable or a key exposed, and those don't surface as errors. That is exactly why they get missed until someone finds them.
What can the free check see, and what needs a full review?
The free check reads your public external surface, headers, TLS, cookies and email/DNS, and flags secrets left in your front-end; it also detects a Supabase or Firebase backend from your front-end, though it doesn't query it. The deeper flaws, whether your data is readable without a login, who can write or change it, and the access-control logic in your code, live inside the app and are what a full Secvura review covers.
Is the check really free?
Yes, free and with no sign-up. You get an A-to-F Surface Score and every issue scored by severity and fix effort, the same way we score a full report.
More free checks
Go deeper than the free check on your AI-built app
A full Secvura Application Security Review is a hands-on assessment that reaches the inside risks an external check can’t: who can write or change your data, your storage and access-control logic, and the flaws that actually cost teams real money, with a clear plan your team can act on the same day.
£1,200
fixed price · report in 1–2 weeks · reply within one working day
Not ready? Start with the free Surface Check and see the quality of the findings first.