4 security checks to run before you publish an app built with AI

🔓 If you built an app with AI without knowing how to code, try this check.

The fastest test: change the user_id in the URL

Change ?user_id=123 to ?user_id=124: if another user’s data shows up, your app is vulnerable.

Sometimes changing one parameter in the URL is enough to read other users’ data.

In the worst cases, APIs left open expose names, emails, addresses or orders without even logging in.

The other classic mistakes

Then there are the other classics:

• admin panels with no authentication
• API keys in the code that reaches the browser
• file uploads without proper checks

The app works, but the AI’s yes counts for little

The problem is that the app often works perfectly.

Users sign up.

Payments go through.

No error shows up.

You may even have asked the AI: “Check that it’s secure.”

And it said yes.

That yes, on its own, counts for little. Analyzing the code doesn’t mean anyone has actually verified the published app, the exposed APIs and the user permissions.

The 4 checks before you publish

💡 Before you publish, check at least these things:

1) Change the parameters in the URL

Try ?user_id=124, 125, 126. If you reach data that isn’t yours, you have an authorization problem.

2) Check what reaches the browser

API keys, tokens and passwords must not be there. If they reach the browser, consider them public.

3) Try the internal pages

/admin, /debug, /test: they have to be protected, not just hard to find.

4) Don’t stop at the AI’s check

If the app handles other people’s data or money, it needs a real test.

Checks like these — permissions, exposed secrets, internal pages — are part of every release when building custom software for companies.

AI makes publishing an app much easier today. Including a vulnerable one.

Have you ever tried to break your own app before letting your users near it? 👇🏻