A big customer sent a security questionnaire for your AI-built app

What the questionnaire is really asking

Security questionnaires look long, but most of them come back to a handful of questions:

• Who can access which data, and is that enforced on the server?
• Where is the data stored, and which other companies process it?
• Is it encrypted, in transit and at rest?
• Who has admin access, and how is it protected?
• Are there backups, and has anyone tested restoring one?
• How are changes tested before they reach customers?
• What happens if there’s a breach, and who would you tell?

Answer each one truthfully. “In progress, complete by March” is a far better answer than a guess that turns out to be wrong, and the prospect’s security team will usually respect it.

Why AI-built apps struggle with these questions

Tools like Lovable, Bolt and Replit are brilliant at getting a working product in front of customers. They’re weaker at the parts a questionnaire asks about. One scan of more than 1,400 live vibe-coded apps found 58% had at least one critical vulnerability, and other research found AI-generated code carries 2.74 times the vulnerabilities of human-written code (both reported by Manchester Digital).

The common problems are predictable:

• Database rules that let any signed-in user read other customers’ records.
• Secret keys in the front-end code, where anyone can find them.
• No separate test environment, so every change is tested on live customers.
• No automated tests, which is why each new feature breaks something else.
• Backups that exist in theory but have never been restored.

Fix it or rebuild it?

If an agency has quoted to rebuild everything from scratch, ask what’s actually wrong with what you have. Customers already pay for it, and the hard part, working out what they need, is done.

Decide part by part, not all or nothing. Most apps end up mostly kept, with a few pieces replaced.

The order to fix things in

1. Access control and secrets. Make sure every customer only sees their own data, and move keys out of the front end.
2. Backups and recovery. Test a restore, and write down how long it takes.
3. A safe way to release. A test environment and a simple release process.
4. Tests on the paths that matter. Sign-in, payments and anything that touches customer data.
5. Monitoring. Know about errors before customers tell you.
6. Then answer the questionnaire, with answers that are now true.
7. Then features again, on a codebase that no longer fights back.

The production checklist goes into more detail on each step.

How we help

Start with a free queue review: we look at what you have, decide what to keep and what to replace, and tell you what the first month would ship, before you pay anything. On a subscription, the security and stability work goes to the top of the queue, and a senior developer designs, reviews and tests everything before it reaches you. If you don’t have a CTO, the monthly CTO and planning session on Embedded Plus is half the value. We can’t promise you’ll pass any particular review or due diligence. We can make sure your answers are true. How we work with founders with AI-built apps.

Questions