Short answer
Before an AI-built app goes to real users, check who can read which data, where the secrets live, how payments fail, how you’ll know when something breaks, and how you’d recover. 2026 has shown what happens when those steps are skipped: thousands of AI-built apps exposed data online.
Why this matters now
AI app builders make a working demo easy. The parts nobody sees in a demo are where things go wrong. In May 2026, researchers at RedAccess reported around 5,000 apps built on Lovable, Base44, Replit and Netlify exposing sensitive data with little or no authentication (Axios). A separate scan by Escape of 5,600 publicly deployed vibe-coded apps found more than 2,000 high-impact vulnerabilities, over 400 exposed secrets and 175 cases of exposed personal data (VentureBeat). Lovable itself left some projects’ source code and credentials exposed for 48 days in early 2026 (The Next Web).
1. Access and data
- Is every page and API behind proper authentication?
- Are roles enforced on the server, not just hidden in the interface?
- If you use Supabase or similar, is row-level security switched on for every table, with policies that match who should see what?
- Can one user see another user’s records by changing an ID in the URL?
2. Secrets and keys
- Are API keys and service credentials kept out of the front end and out of the repository?
- Has anything secret ever been committed, such as a .env file? If so, rotate it.
- Are third-party keys limited to only what they need?
3. Payments and edge cases
- What happens when a payment webhook fails, arrives twice or arrives late?
- Are refunds and cancellations handled, not just the happy path?
- Are prices and totals calculated on the server?
4. Monitoring, backups and recovery
- Will you know about an error before a customer emails you?
- Are there backups, and have you tried restoring one?
- Who gets the alert at 2am, and what do they do?
5. Code you can keep building on
- Is there a sensible structure, or one enormous file the AI kept appending to?
- Are the important flows covered by tests?
- Could a new developer understand it in a day?
6. The legal basics
- A privacy notice that matches what the app actually collects.
- Cookie consent where you use non-essential cookies.
- Accounts for hosting, domains and app stores in your company’s name.
If the list looks long
It usually doesn’t mean a rebuild. Most prototypes have a good idea and a decent shape underneath. Prototype Rescue starts with a senior review and a prioritised fix list. If you’ll keep adding features afterwards, the subscription carries it on.
Questions
Is Lovable or Bolt code safe to use in production?
It can be, once someone has reviewed it. The tools generate working code quickly, but security settings such as database access rules are often missing or wrong unless someone checks them deliberately.
Do we need to rebuild our AI-built app?
Usually not. Keep what works, fix what’s dangerous and rebuild only the parts that won’t survive real users.