An AI builder wrote your app, and it has worked for three weeks. Now you want real customers and real data on it.
We use these tools every day at The Tech Thingy, and they are genuinely good. But AI builds what you ask for, and most founders do not know to ask for the boring safety parts.
This is not theory. In 2025, a security researcher found that many apps built on one popular AI builder had database access rules missing or set up wrongly. A follow-up scan found over 170 projects where data could be read without logging in.
Here are the six checks we would run before any AI-built app goes live.
1. Are your secret keys hidden from the browser?
Your app uses keys to talk to the database, payment gateway, SMS and email services. Some keys are meant to be public. Others are master keys that must never reach the browser.
AI builders sometimes put a secret key in front-end code because it is the quickest fix. Anyone can then copy it from the browser and read your data or run up your bills.
On Supabase, for example, the public "anon" key is meant for the browser, but the "service_role" key bypasses all access rules and should only ever live on a server.
How to check: Open your live app in Chrome, right-click, choose Inspect, and search the Sources tab for words like "secret", "service_role", "sk_live" and "key". Move any private key to the server, then rotate it at the provider, because the old one is already exposed.
2. Can one customer see another customer's data?
This is the check that caught out those 170+ apps. Many AI builders connect your app directly to a database such as Supabase, which is fine only if the database enforces who can read each row. In Supabase and Postgres this is called row-level security, or RLS.
Without it, your screens show customers only their own orders, but the database hands everyone's orders to anyone who asks directly.
How to check: In your database dashboard, confirm RLS is turned on for every table that holds customer or business data, and that each table has policies such as "users can only read rows where user_id matches their own". Then log in as a test customer and try loading another customer's record by changing the ID in the request.
3. Do logins and roles actually stop people?
Hiding a button is not blocking an action. AI-built apps often hide the Admin menu but leave admin pages open to anyone who types the address.
How to check: Make one test account for each role. Log in as the lowest role and try opening admin URLs directly. Check that sign-up cannot create an admin and logged-out users are always sent to login.
4. If the data disappeared tonight, could you get it back?
A backup you have never restored is a hope, not a backup. Free and starter database plans often keep very short backup windows.
Data gets lost in ordinary ways: a bad AI-suggested change, a wrong delete, or a suspended account.
How to check: Find out how often your database is backed up, how long backups are kept, and where they live. Then restore one into a separate test project and time it. Repeat monthly.
5. Is every account in your company's name?
We have written before about what happens when your app developer disappears. AI-built apps carry the same risk, because they often get set up on whoever's email was handy.
How to check: List every service the app depends on: the AI builder project, code repository (GitHub or GitLab), domain, hosting, database, payment gateway, SMS and email providers, and app store accounts. For each, note whose name and card it is on. Move anything critical into a company account with two owners from your business.
6. Will you know when something breaks?
When an AI-built app fails in production, it often fails silently. A payment goes through but the order is never saved, and you hear about it days later from a customer.
Payment gateways like Razorpay and Stripe can send the same webhook notification more than once. If your code is not written to handle repeats (developers call this idempotency), one payment can create two orders or two invoices.
How to check: Set up error monitoring (tools such as Sentry have free tiers) and confirm alerts reach a phone or email someone reads. For payments, send a test webhook twice and confirm only one order is created.
What about India's data protection law?
If your app collects names, phone numbers, addresses or other personal details of people in India, the Digital Personal Data Protection Act, 2023 applies. The government notified the DPDP Rules in November 2025, with obligations coming into force in phases over about 18 months.
In general terms, businesses must explain what data they collect and why, take consent, keep reasonable security safeguards, and report breaches. Penalties for failing to keep reasonable security safeguards can go up to ₹250 crore. For your specific obligations, speak to a legal adviser.
What does a one-screen pre-launch checklist look like?
- No secret keys visible in the browser; any exposed key rotated
- Row-level security on for every table, tested with two customer accounts
- Each role tested; admin pages blocked for non-admins
- Backups confirmed and one restore actually tested
- Domain, code, hosting, database, payments, SMS and email in the company's name
- Error alerts going to a real person
- Payment webhooks tested twice with no duplicate orders
- Privacy notice and consent in place for personal data
If several are unclear, that is normal, and better to know now. Our guide on whether AI can build your website or you need a developer explains where AI tools stop and people step in.
Frequently asked questions
- Are apps built with Lovable, Bolt or Replit safe to launch?
- They can be, but access rules, key handling and roles are often incomplete by default. Run the checks above before real customer data goes in.
- Do I need to rebuild my AI-built app before going live?
- Usually not. Most issues we see are fixable: moving keys to the server, adding access rules, tightening roles and setting up backups.
- Does the DPDP Act apply to a small business app?
- If you process digital personal data of people in India, the Act generally applies regardless of business size. The Rules are being phased in, so check your obligations with a legal adviser.
Want a second pair of eyes before you launch? Our software development team reviews AI-built apps, fixes what is risky and leaves you owning everything. Tell us what you built and we will tell you honestly what needs attention.
Want a second pair of eyes before you launch?
Get a pre-launch review of your AI-built app before customer data goes in.
Get a pre-launch reviewSources
- CVE-2025-48757, 170+ Lovable projects with missing or weak row-level security: [superblocks.com](https://www.superblocks.com/blog/lovable-vulnerabilities)
- PIB: DPDP Rules notified 14 Nov 2025, 18-month phased compliance: [pib.gov.in](https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf)
- The Week: DPDP Rules phased rollout: [theweek.in](https://www.theweek.in/wire-updates/business/2025/11/14/del148-biz-dpdp-rules-ld-govt.html)
- Supabase API keys (anon key vs service_role key): [supabase.com](https://supabase.com/docs/guides/api/api-keys)