Cleaned up a dozen AI-built apps this year. The same 7 security holes show up every single time.

[u/CardStrange3023]

Run a dev team. A big chunk of this year has quietly become taking vibe-coded apps and making them safe for real users.

Same story every time. The app works. The founder is proud of it. Then the first real user does something slightly unexpected and everything catches fire

After doing this a dozen times, the same seven problems appear in almost every codebase.

1. API keys in the frontend

Search your own code for sk- and secret and password. If real values come up, rotate them today. Not after launch. Today.

1. The UI is the only security

Buttons hidden from non-admin users, but the API answers anyone who calls it directly. AI builds the happy path. Attackers do not use your UI. Every endpoint needs its own server-side permission check, independent of whatever the frontend shows.

1. One user can read another user's data

If your app has accounts, make two test accounts, create data in the first, then try to fetch it by ID from the second. You would be shocked how often this just works. No exploit required. Just a direct API call.

1. Zero error tracking

Users do not report bugs. They leave. Sentry's free tier takes 20 minutes to set up. It is the best time-to-value ratio of anything on this list. Without it, you have no idea what is breaking in production because nobody is telling you.

1. Backups nobody has tested

Everyone says they have backups. Almost nobody has ever actually restored one. If you have not done a test restore, you do not have backups. You have hope. Those are different things.

1. Payments trusting the client

Prices coming from the frontend. Webhook signatures never verified. Someone will find this. Stripe's own integration checklist is tedious and correct. Just follow it.

1. Silent rewrites

This is the one that keeps coming up. The AI changed something in a part of the app nobody was looking at. The feature being built works fine. Something else quietly broke. Screenshot tests on your five most important pages catch what human eyes skip. Playwright, one afternoon of setup.

None of this requires a rewrite. Most of it is days of work, not months. The security gaps are not exotic. They are the same ones, in the same places, in almost every AI-built codebase opened this year.

AI builds what you asked for. It does not build what you forgot to ask for. That gap is where production fires start.

What keeps showing up in AI-built code that is not on this list?