The 7 Most Common Security Holes in AI-Generated Apps
AI assistants are brilliant at getting an app to *work*. They are far less reliable at making it safe. The model optimizes for the happy path you asked about, not the attacker's path you didn't. After scanning thousands of AI-built apps, the same seven holes show up again and again — and almost all of them are one-line fixes once you know where to look.
1. Secrets committed to the repo or shipped to the browser
The single most common — and most expensive — mistake. An AI assistant wires up Stripe or OpenAI, hard-codes the key to make the demo work, and it ends up in your client bundle or your Git history. Anyone can read it.
Server secrets must stay on the server. In Next.js that means no `NEXT_PUBLIC_` prefix; in Vite, nothing in the client bundle. We cover this in depth in Stop Leaking API Keys.
2. A Supabase or Firebase database with no access rules
AI tools love Supabase and Firebase because they're fast to set up. The catch: a fresh table or collection is wide open until *you* add Row Level Security or security rules. The public anon key is meant to be public — the protection is the policy layer behind it.
If you skipped that step, anyone with your (public) key can read or wipe your whole database. See Is My Supabase Database Exposed?.
3. Missing security headers
No Content-Security-Policy, no HSTS, no clickjacking protection. These don't cause a breach on their own, but they remove the guardrails that contain one. They're also trivial to add — usually a few lines of config. We break them down in Security Headers, Explained.
4. Publicly accessible .env, .git, or backup files
A misconfigured deploy can serve your `.env`, your `.git` directory, or a `db-backup.sql` straight off the public URL. Attackers scan for these automatically, around the clock. If yours is reachable, it will be found.
5. Insecure cookies and session handling
Session cookies without `HttpOnly` are readable by any JavaScript on the page, which turns a small XSS bug into full account takeover. Missing `Secure` and `SameSite` widen the blast radius further.
6. Overly permissive CORS
`Access-Control-Allow-Origin: *` on an authenticated API lets any website make requests on your users' behalf. AI assistants reach for the wildcard because it makes the error go away — not because it's correct.
7. No rate limiting on sensitive endpoints
Login, password reset, and AI-proxy endpoints with no rate limit invite credential stuffing and runaway bills. The model rarely adds this unless you explicitly ask.