Security guides for apps built with AI

Plain answers to the security questions founders ask, with the sources behind them.

• Before you go live: a security checklist for apps built with AI

  Ten checks before you launch an app built with AI tools such as Lovable, Bolt or Base44: why each matters and how to test it.

• What can a stranger see in your app?

  Everything your web app sends to the browser is public: its code, its database address, its keys. What is fine, what is not, and how to check your own app.

• Can users get your paid features for free?

  Yes, if the browser decides that a payment happened. How to check your app built with AI, and how to let only your server set paid, plan and credits.

• Someone is running up your AI bill: what to do now

  Your AI key leaked, or a bot is calling your AI feature. Stop the spending in the next hour, find the cause and fix it for good.

• Sign-up without email confirmation: is it a risk?

  When open sign-up without email confirmation is a real risk, how to check your own app, and how to turn on confirmation, CAPTCHA and rate limits.

• Can anyone upload files to your app at your cost?

  If a storage rule lets visitors who are not signed in add files, strangers can fill your app’s storage at your cost. How to check it and close it.

• Can one customer see another customer’s data?

  Two different leaks: tables open to anyone, and tables any signed-in user can read. How to test with two accounts and fix it with Supabase rules.

• My Supabase public key is visible. Is that a problem?

  No. The Supabase public key is meant to be in your app. The real risks are tables with missing or too-open access rules and a secret key in browser code.

• Base44 app security: what a stranger can read

  A stranger can read any Base44 entity whose Read rule is All Users, and all your browser code. How to check your own app and fix it with Base44’s AI.

• Is your AI builder’s own scan enough?

  What the Lovable, Replit, Bolt and Base44 scans check, what they cannot see, and why you should also test the live app from outside.

• Security headers and CORS, in plain words

  What security headers and CORS do, the five headers a small app needs, how to check your site for free, and how to set them on your host.