AI security mistakes that get apps hacked.

AI builders make shipping fast. They also make the same few security mistakes over and over. Here are the ones to check before launch.

1. Secret keys in frontend code

AI tools happily paste an OpenAI or Stripe secret into a React component to “make it work”. Ask the AI explicitly to move the call to a server function. Leaked-key stories →

2. Database open without login

Supabase/Firebase tables without Row Level Security or rules can be read by anyone holding the public key — which is everyone. 16,000+ Supabase databases exposed →

3. App left public by default

Researchers found thousands of vibe-coded apps reachable by anyone with the URL, some indexed by search engines (see sources on our Trends page). Check your platform’s visibility setting. Sources on Trends →

4. Fake authentication

Hiding a page behind a client-side check is not security. Data must be protected on the server/database, not just hidden in the UI. Lovable-hosted app exposed 18,697 records →

5. Exposed .env and .git

Misconfigured hosting can serve your environment file or git folder directly.

6. No security headers

Missing CSP, HSTS and X-Frame-Options make XSS and clickjacking easier.

7. Trusting untrusted repos and MCP configs

Opening an untrusted project in an AI coding agent can run its config. Check Point disclosed (now patched) Claude Code issues where project files could exfiltrate API keys. The Claude Code project-files story →

8. Never rotating

Leaked keys often stay valid for years. Rotate after any suspected exposure. GitGuardian data on Trends →