AI security · Code

AI-built app security check.

AI coding tools let small teams ship in days. They also ship the same mistakes, fast: open databases, secret keys in the code, pages anyone can reach without logging in. We find them before your customers, or a stranger, do.

Get a fixed-price quote
Code and live app both testedFixes written for your AI tool tooFree retest
app check · sample● demo
  1. FOUND Database table readable without login
  2. FOUND Payment secret key in front-end code
  3. FLAGGED Admin page hidden but not protected
  4. FIXED Row-level security switched on
  5. PASSED No secrets in git history
In plain words

An AI-built app check is a fast security review of software written mostly by AI coding tools, sometimes called vibe coding. We review the code and test the running app for the holes these tools commonly leave: exposed keys, databases open to anyone, missing access checks and risky dependencies. You get a short, prioritised fix list your developers, or your AI tool, can work through, and a free retest.

Duration
3–7 working days
Method
OWASP Top 10 · ASVS
Built with
Cursor, Lovable, Bolt, Replit, v0, Copilot
Pricing
Fixed fee
What we look for

The usual holes in AI-built apps.

AI tools build what you ask for. Security is usually what nobody asked for.

  • Secrets in code

    API keys, payment keys and database passwords in front-end code or git history.

  • Open databases

    Supabase or Firebase rules that let anyone read or write data.

  • Missing access checks

    Pages and APIs that work without logging in, or let one user see another user’s data.

  • Hidden but unlocked pages

    Admin screens that are not linked anywhere, but are not protected either.

  • Risky dependencies

    Old, abandoned or invented packages, including names AI tools make up that attackers then register.

  • Injection bugs

    SQL, command and script injection in forms and APIs.

  • Weak sign-up and reset flows

    Password reset, email verification and invite links that can be abused.

  • Debug and test leftovers

    Debug modes, sample accounts and test endpoints left switched on.

  • AI features inside the app

    If your app calls an AI model: prompt injection and cost-abuse risks too.

How it goes wrong

How a weekend app leaks its users.

  1. Your teamA founder ships an MVP in a weekend

    The AI tool wires up sign-up, a database and payments. Everything works in the demo.

  2. Your systemsThe database rules are left open

    The default lets anyone holding the public key, which sits in the page, read every table.

  3. AttackerSomeone opens the browser’s developer tools

    The key and table names are right there. A few lines of script download every user.

  4. Your dataPersonal data is out

    Names, phone numbers and orders of every customer. Under the DPDP Act that can be a reportable breach.

  5. The fixThe fix

    Row-level security on every table, keys moved to the server, access checks on every API. Often half a day of work. We retest to confirm.

A known pattern

In 2025 a researcher reported that apps generated by one popular AI app builder were shipping with missing database access rules, exposing user data from more than 170 apps (CVE-2025-48757, explained by Superblocks).

The tools keep improving, but they still build what you ask for, not what you forgot to ask for.

How it works

Under a week, start to finish.

  1. Day 1

    Scope

    Read-only repository access, a staging link and a test account for each role.

  2. Days 1–3

    Code review

    Automated scans plus a person reading the sign-in, data access and secrets code.

  3. Days 2–5

    Live testing

    We attack the running app the way an outsider would.

  4. Days 5–6

    Fix list

    Short and ranked, with copy-ready fixes and prompts you can give your AI coding tool.

  5. After your fixes

    Retest

    We confirm each fix works.

What you get

A fix list you can finish this week.

HANULSECAI-built app security check CLIENTSample · D2C ordering app SUMMARY FOR LEADERS FINDINGS BY SEVERITYCritical2High3Medium4Low3 COVERAGE · OWASP TOP 10 · ASVS RETEST PASSED Sample layout, not client data
  • 01
    Prioritised fix list

    Ranked by real risk, written so a non-specialist can follow it.

  • 02
    Copy-ready fixes

    Code changes, or instructions to paste into your AI coding tool.

  • 03
    Secrets clean-up

    Which keys to rotate, and how to keep them out of code for good.

  • 04
    Free retest

    We check every fix.

Who it is for

Shipped fast? Check it before you scale.

  • Founders and small teams who built with Cursor, Lovable, Bolt, Replit, v0 or Copilot
  • Startups about to launch, raise money or sign their first enterprise customer
  • Agencies delivering AI-built apps to their clients
  • Internal tools built quickly by people who are not developers
  • Any app that stores customer data or takes payments

Before you launch

A check of three to seven days costs far less than a breach notice, and it is a good answer when an investor or customer asks “has this been security tested?”

Larger or regulated app? You need full penetration testing (VAPT).

Standards

Tested against proven checklists.

OWASP testing guidesWeb, API and mobile
CVSS and EPSSSeverity and exploit odds
DPDP Act 2023With the DPDP Rules 2025
ISO/IEC 27001Information security

Emblems are HanulSec’s own artwork showing which frameworks our work maps to. They are not the owners’ logos and do not mean HanulSec is certified against them.

Questions

Questions buyers ask before they call us.

Q01What is vibe coding, and why is it risky?
Vibe coding means building software mostly by describing it to an AI tool and accepting what it writes. It is fast, but the AI optimises for “it works”, not “it is safe”, and the person shipping it may not know what to check.
Q02Is this a full penetration test?
No. It is a focused check for the most common holes in AI-built apps, priced for startups. Larger or regulated apps should get a full penetration test (VAPT).
Q03Do you need our source code?
Read-only access helps us find more in less time. Without it we can still test the live app from the outside.
Q04Which tools and stacks do you check?
Apps built with Cursor, Lovable, Bolt, Replit, v0, GitHub Copilot, Claude Code and similar tools, typically on Next.js, React, Supabase, Firebase, Vercel, Node.js or Python.
Q05How long does it take?
Three to seven working days, plus a free retest after your fixes.
Q06How much does it cost?
A fixed fee after a free scoping call. It depends on the size of the app, the number of user roles and whether code access is available.
Next hops

Related services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings