Is my app built with AI safe? A non-developer's check

You described an app, an AI built it, and it works. Somewhere between the excitement and the launch, a quieter worry set in: you don't actually know if it's safe, and you're not a developer who can just read the code and find out. That worry is reasonable — and it's checkable.

Here's the honest version, in plain language: AI tools are great at making an app work. They're much less careful about who else can get in once it's live. The good news is that the handful of things that usually go wrong are the same every time, and you can check them without writing a line of code.

First, the reassurance

"Built with AI" does not mean "insecure." It means the safety checks nobody prompted for probably didn't happen on their own. A working AI-built app is a house with the lights on — you just haven't confirmed the doors are locked yet. Confirming that is a short list, not a rebuild.

The four questions that matter most

1. Can strangers read your data? The most common serious gap: the database is readable by anyone, not just logged-in users. If your app uses Supabase, this is the "is my database public?" question, and it has a clear yes/no answer.
2. Are secret keys visible in the app? Some keys are meant to be public; some are like a password and must never be visible. Telling them apart is the "my key is showing" question.
3. Can someone skip the buttons? Hiding an admin action in the interface isn't the same as blocking it. If the only thing stopping a normal user from deleting everything is that the button is hidden, that's not locked.
4. Is anything left over from building? Test pages, admin panels, and setup routes the tool created and never removed can still be live.

How to check without being a developer

You have two doors here, and you don't need code for either.

For the outside-facing stuff — is the connection secure, are the basic protections in place — you can scan your live web address in seconds:

For the inside stuff — the database, the keys — the trick is to make the same AI that built your app check its own work, in plain English. Paste this and it'll walk you through each fix step by step:

I built an app with an AI tool (like Lovable, Bolt, v0, or Cursor) and I'm not a developer. I'm worried it might not be secure. Check it for me and explain everything in plain English, no jargon — and if you use a technical term, define it in the same sentence.

Please go through these one at a time and, for each, tell me (a) whether my app is affected, (b) how bad it is in plain terms, and (c) exactly what to click or paste to fix it:
1. Can strangers read my database? (If I use Supabase, check that "Row Level Security" is on for every table with a real rule, not off and not "allow everyone".)
2. Are any secret keys or passwords visible in the app's code that people could copy?
3. Can someone do an admin-only action just by calling the address directly, even though the button is hidden?
4. Are there any test or admin pages still live that should've been removed?

Assume I will not understand code — walk me through fixes step by step.

If you built with a specific tool, we go door-by-door for Lovable, Bolt.new, and v0. The full technical version, if you want it, is vibe coding security risks.

After you've checked it

Securing the app is a one-time pass. Keeping it that way is the part people forget — a certificate quietly expires, the site goes down while you're asleep, an address stops responding. You don't want to learn any of that from a user.

That's the whole idea behind watching an app from outside: it tells you the moment something changes, in plain terms, so a non-technical founder isn't the last to know their own app is down.