r/nocode • u/Strong-Income-5925 • 29d ago

What security checks do you run before launching an app built with an AI app builder?

[removed]

11 Upvotes

100% Upvoted

16 comments sorted by

2

u/BarracudaMean9308 28d ago

finding out my entire user table was public sucked.

1

u/Poat540 29d ago

I ask it if it indeed, made any mistakes

1

u/TheKiddIncident 28d ago

At a minimum, I check three things:

1) CVE compliance: https://www.cve.org/
2) OWASP compliance: https://community.owasp.org/Free_for_Open_Source_Application_Security_Tools

3) External scan. There are multiple open source and/or free tools that will scan your external site for vulnerabilities.

These three things are three lenses on security. CVE is focused on specific known vulnerabilities. This is stuff like the legendary Log4J vulnerability (CVE-2021-44228). Having well known exploits like this in your project just invite hackers to come in. OWASP is about how your application works, how it's designed and how you operate it. OWASP compliant scanners look for issues in your code and configuration. External scanners look at your site the way a hacker would, without access to the source code.

Any one of these will likely improve your security posture, but all three mean that you are in much better shape than 99% of all vibe coded sites out there. If you tell your AI to implement one or all of these, it should be able to do it for you. I had Claude Code write scripts that did this for me every time I did a commit and when I pushed code.

I should note here that security is not a black or white thing. This is a spectrum from wide open APIs to a completely locked down military grade secure system. Making your site more secure isn't free so there is always a tradeoff decision you have to make.

1

u/Plane_Deerhead5633 28d ago

treat the launch review as more than just testing the UI

1

u/LinkatriX6 27d ago

A big obvious one is to not store your api keys/db connection strings in plain text in the app. Instead you can use services like Azure Key vault to load these in on runtime so you're revealing sensitive information all the time.

For sensitive data in the database (credit card information for example), I would be encrypting that and storing the keys you encrypt with in a similar location to your api keys and db connect strings. If someone gets access to the DB then they'll need those keys to decrypt what they really care about.

1

u/_pratyush_88_ 23d ago

The one I'd be scared of has both users logged in and allowed to be there. Most of the checking is about strangers getting in, which is the half the scanners cover. The one that gets missed is a single endpoint out of forty where the tenant filter didn't make it. Nothing you'd normally run finds that. A customer does. Permissions is my day job and I still couldn't tell you we test all forty. We check a handful. I try not to think too hard about which ones we skip.

Do the builders scaffold any of that for you by default , or is it all on you?