Common risks
AI writes code that looks finished while quietly leaving these behind. Each one is common, each one is real, and each one has bitten a founder who thought they were ready to ship.
What's wrong AI tools often paste secret keys straight into the source — and then that code gets pushed to a public GitHub repo.
What it costs you Bots scan public repos within minutes. Stolen Stripe or OpenAI keys get used to run up thousands in charges on your account.
What's wrong With Supabase or Firebase it's easy to ship without turning on row-level security, leaving every table readable by the public.
What it costs you Anyone can open the browser console and download all your users' data — emails, private records, sometimes passwords.
What's wrong Access is hidden in the interface but never enforced on the server.
What it costs you Anyone can call your API directly, or change an ID in the URL, and read or edit data that isn't theirs.
What's wrong No automated backups of your database, and the code may only live inside your AI tool's sandbox.
What it costs you One bad migration or deleted file and your data — and your app — are gone, with no way back.
What's wrong Your AI or payment endpoints have no rate limiting and no usage cap.
What it costs you One script in a loop can turn a $20 month into a $5,000 bill overnight — and you find out when the invoice lands.
What's wrong The app renders entirely in JavaScript, with no page titles, descriptions, or server-rendered content.
What it costs you Search engines see a blank page, so you can't be found — and you end up paying for ads to get any traffic at all.
Free risk report
Send us your repo or a link to your app. Within a couple of days we send back the top risks we find, in plain language. No credit card, no sales pitch.
Get my free report