What is this site exposing?

Try

Common Security Failures in AI-Built Apps

  1. Row Level Security is missingYour frontend can connect to the database, but the tables have no RLS rules. Anyone who finds the public client key may be able to read every row, and sometimes update or delete them too.
  2. Secrets end up in the frontendAPI keys, payment keys or service-role tokens are added to client-side code. Once the app is deployed, those values can be extracted from the browser bundle and used outside your app.
  3. Admin access only exists in the UIThe app hides admin buttons from normal users, but the API itself does not check permissions. Someone can call the endpoint directly and bypass what the interface is hiding.
  4. Any record can be fetched by changing the IDThe app loads data using an ID from the URL or request without checking who owns it. Changing that ID can return another user's account, order, document or private data.
  5. Users can change protected account fieldsFields such as role, plan, credits or balance can be updated by the user. Someone can change their own account to admin, paid or unlimited without going through the intended flow.
  6. Expensive endpoints have no limitsAI calls, emails, SMS, image generation or other paid APIs can be called without rate limits. A script can burn through your credits or generate a large bill very quickly.
  7. The client decides how much to chargeThe frontend sends the payment amount and the server trusts it. A user can change the request before sending it, or fake payment events if webhook signatures are not verified.
  8. .env or .git files are publicly accessibleDeployment or server configuration exposes files that should never be reachable from the web. A simple request can reveal database URLs, API keys and other credentials.
  9. The app trusts local storageRoles, user IDs or account status are stored in the browser and treated as trusted values. Users can edit local storage themselves, so it should never decide what they are allowed to do.
  10. Login tokens are not properly verifiedThe app accepts session tokens without fully checking their signature, expiry or issuer. In the worst case, someone can create their own token and pretend to be any user.