Guide
Security checklist for AI-built apps
To secure an AI-built app, confirm five things: the database has access rules, no secret keys shipped to the browser, no .env or source maps are public, security headers are set, and every exposed secret has been rotated. Each is checkable from your live URL, and together they cover the issues AI builders most often leave open.
The five checks
- Database access rules are on. Row-level security for Supabase, security rules for Firebase, scoped to each user.
- No secret keys in the browser. Only publishable keys belong in client code. Service-role, secret payment, and cloud keys stay server-side.
- No public .env or source maps. Neither should be reachable from your domain.
- Security headers are set. Frame protection, content-type protection, and a sensible cross-origin policy.
- Rotate anything that leaked. Any secret that was ever public is already collectable, so replace it.
Why from the outside is the right test
You can check each item by reading your code, but the test that matters is what actually shipped, because the deployed app is what an attacker sees. Reading only what the browser receives, the bundle, the endpoints, the headers, tells you the real state of the live app, not what the code was supposed to do.
Service-role, secret payment, and cloud keys stay server-side.
Run the checklist automatically
Every item above is what Plaintext checks when you paste your URL. It reports them worst first, in plain language, with the exact fix for each. The first scan is free.
Frequently asked
How do I secure an app built with AI?
Set database access rules, keep secret keys server-side, make sure no .env or source maps are public, add security headers, and rotate any secret that leaked. These five checks cover what AI builders most often leave open, and each is testable from your live URL.
What is the most important security check for an AI-built app?
Database access rules. An open database, like Supabase with row-level security off, is the most common and most damaging issue, because it exposes all your user data to anyone with the public key that ships in the app.
Check your own app in about a minute. Paste your URL and Plaintext reads the shipped JavaScript, the public endpoints, and the database rules for the exact holes Lovable, Bolt, Cursor, v0, and Replit leave open. The first scan is free.
Scan my app