Your AI-built app shipped in a week. Was it checked in a week too?

In January 2026, someone built a complete app without writing a single line of code themselves. Within three days of launch, their entire customer database was sitting wide open on the internet, no login required. This isn't a one-off. It's what happens when speed beats a check that nobody skips on purpose, but almost everyone skips because they're moving fast.

The problem, in numbers

Research at large enterprises found that developers working with AI ship three to four times as much code, but generate ten times as many security findings. That number does not prove AI-written code is ten times more dangerous per line. It could just as easily mean the pace of shipping is outrunning human review capacity. What we do know for certain: Veracode ran a controlled test across more than 100 AI models, specifically on security-sensitive coding tasks, and 45 percent of that code contained a known vulnerability. That's not a claim about your random production codebase, but it does show that the models you use every day can demonstrably produce this kind of mistake.

What actually went wrong

The key to the database was just sitting there, visible in the website's own code. On its own, that's not necessarily a problem. That kind of key is often meant to be used by every visitor's browser. It only becomes a problem when the lock behind it is missing, the rule that says: everyone may only see their own data. That lock was off. The result: any visitor could read the entire customer table without ever logging in.

Check it yourself in five minutes

1. Open your site, hit F12, go to the Network tab.
2. Refresh the page and look through the requests for anything containing "supabase" or "key".
3. Found one? Note the project name that goes with it.
4. The next question is whether there's actually data sitting behind that key without a login. Confirming that yourself takes a bit more technical know-how than the first three steps. A developer can usually confirm it for you in two minutes.
5. Not sure? Just ask whoever built the app, or have it checked.

A fair caveat: this one check is a smoke detector for exactly one common, well-known mistake. It is not a full security audit. A real review also looks at whether user A can ever reach user B's data by simply changing a number in a link, whether authorization is actually enforced on the server instead of only in the frontend, and what exactly gets sent toward an AI model like OpenAI or Anthropic when someone enters sensitive information. This checklist catches one mistake we saw at multiple real apps today. Everything else needs a broader review.

Bottom line

This costs five minutes to check and can save you months of cleanup. If you'd rather have someone else check it for you, I'm happy to help.

Sources: research on AI code quality at Fortune 50 companies, Veracode's test of more than 100 AI models on security-sensitive code, and the publicly documented Moltbook case from January 2026.