Security and data in AI-built apps: the risks nobody warned you about
AI writes code that works. It does not, by default, write code that is safe. The most common — and most avoidable — security gaps we find in generated applications.
An AI assistant is optimised to make your app work. Making it safe is a separate concern that only gets addressed if someone asks for it — and most people building their first app do not know to ask. None of this is a reason to avoid AI-built software. It is a reason to have someone check it before it holds real data.
Secrets in the frontend
API keys, database credentials and tokens embedded in client-side code are visible to anyone who opens the browser tools. This is the most common issue we find, and it is also one of the most damaging.
No real access control
"Anyone with the link" or a single shared password is not access control. If different people should see different things — and with customer data they must — you need real authentication and a permissions model, checked on the server, not just hidden in the interface.
Unvalidated input
If the app trusts whatever the user (or an attacker) sends, it is exposed to a whole family of well-known attacks. Input validation and safe database queries are basic, essential, and routinely missing in generated code.
Personal data without a plan
If your app stores names, emails or anything about people, you have GDPR obligations: a lawful basis, the ability to export and delete, and reasonable protection. "We built it quickly" is not a defence a regulator accepts.
No way to know something went wrong
Without logging and error tracking, the first sign of a breach or data loss is often a customer telling you. Being able to detect and respond is part of security, not an extra.
The good news
Almost all of these are cheap to fix — if they are found before an incident rather than after. A focused security and data review of an AI-built app is a small, fixed piece of work, and it is the single highest-return thing you can do before you let real users and real data anywhere near it.
Built something with AI and need it to last?
We take AI-built apps from prototype to production — audit, hardening, integration with Zoho and ongoing maintenance. Senior-led, AI-accelerated.