Is the app you built with AI safe to put in front of customers?
AI app builders make working apps fast, but they often leave secret keys in the website code, database rules wide open, or test pages switched on. Send us the address of an app you own and we will check it for free, confirm every finding by hand, and tell you in plain English what to fix first.
Works for apps made with Lovable, Bolt, Replit, Cursor, Claude Code, Codex, v0 and hand-written code, including Supabase and Firebase back ends.
The gaps AI-built apps most often have
Items marked “after ownership check” send test requests to your app, so they only run once you have proved you own it.
-
Secret keys in the browser
Public checkAPI keys or tokens shipped inside the website’s code, where anyone can copy them and run up your bill or read your data.
-
Database access rules
After ownership checkWhether your database (for example Supabase) lets a stranger read or change other people’s records. This is the most common gap in AI-built apps.
-
Sign-in and sessions
After ownership checkWeak or missing protection around accounts, password resets and logged-in pages.
-
Security settings on the site
Public checkHTTPS, security headers (instructions your site gives browsers to block common attacks) and cookie settings.
-
Exposed files and pages
Public checkAdmin pages, backups, configuration files or test pages that were never meant to be public.
-
Known-vulnerable components
Public checkLibraries and frameworks with published security problems, matched against current vulnerability reports.
-
Email spoofing protection
Public checkWhether someone could send email that looks like it came from your domain (SPF, DKIM and DMARC records).
-
What an AI tool left behind
Public checkDebug output, sample data, default passwords and open endpoints that code generators commonly leave switched on.
Four steps, no passwords
- Step 1
You send the address
Tell us the app’s public URL, what it was built with and that you own it. No passwords, keys or code.
- Step 2
We check what is public
An automated scanner looks for common gaps, then an engineer confirms every finding by hand, so you do not get a list of false alarms.
- Step 3
Optional: prove ownership
If your app stores customer data, we send a small verification file to place on your site. Then the check also tests database rules and sign-in.
- Step 4
You get a plain-English summary
What is exposed, how someone could use it, and what to fix first, with a ready-to-paste instruction for your AI coding tool where that helps.
What we found
The “orders” table can be read by anyone who has the app’s public key, which is visible in the website code.
Why it matters
A stranger could download every customer’s name, email and order history without signing in.
What to do first
Turn on row-level security (a rule that limits each user to their own records) for that table, then re-test. Urgency: fix before launch.
Three honest options
There is no obligation. The summary is yours whichever you choose.
Fix it yourself
Most findings come with a plain instruction you can follow, or paste into your AI coding tool.
Have Layer7 fix it
A fixed-scope, fixed-price quote to close the issues, test the fixes and re-check. Nothing starts until you agree the price.
Go further
Move the app onto hosting you control, add backups and monitoring, or keep building. See deploy, host and migrate and custom web apps.
What we will do
- Check only apps you own or are authorized to test
- Start with publicly visible information; go deeper only after you add a small file to your site that proves you own it
- Confirm every automated finding by hand before you see it
- Explain each issue in plain English, with what to fix first
- Keep your results confidential
What we will not do
- Call this a penetration test, a certification or a compliance audit
- Promise that an app is “unhackable” — nobody honest can
- Probe deeper than a passive check without written permission and proof of ownership
- Ask for passwords, keys or code through a form
- Publish or share your findings
This check launched in October 2026, so there are no published case studies of it yet. The engineer behind it, Afroz Ahmad (CCIE Emeritus #36102), has spent 20+ years securing and running production systems; see About.
Questions about the check
If yours is not here, ask it in the form below.
Yes. Most AI consulting starts with one question: which repetitive work costs you the most time? Layer7 looks at how the work is done today, says plainly whether AI can help, and builds only what pays back. The AI consulting page explains how that works.
With a free 30-minute call about the one task that costs your team the most time. If AI can help, you get a short written scope and a fixed price. Many first projects are a single automation, such as quote follow-ups or inbox sorting, that pays back quickly.
Yes. Deployment, hosting and migration are part of taking an app live safely: moving it off an app builder’s default hosting, onto hosting you control, with backups and a way back if an update fails.
A first look at an app you own. It starts with what anyone on the internet can already see: secret keys in the website code, missing security settings, exposed files and known-vulnerable components. If you add a small file to your site that proves you own it, the check also tests your database access rules and sign-in, which is where AI-built apps most often leak data. An engineer confirms every finding by hand, and you get a plain-English summary with the most urgent items first.
It is a small text file with a code in it that you (or your AI coding tool) place on your site. It proves you control the app, which is what makes it responsible to test the database rules and sign-in. Without it, the check stays with what is publicly visible.
Most summaries go out within a few business days. Free checks are limited each month and handled in the order received; if there is a wait, you will be told.
They are sent only to you and kept confidential. Layer7 never publishes or shares a client’s findings.
Still have questions?
Request my free checkRequest your free AI app safety check
Tell us where the app lives and what it was built with. You will get a plain-English summary by email, most urgent items first. We aim to reply within one business day.
Contact Layer7
