The 10-minute security check for any AI-built app

You do not need to be a developer to catch the most common security problems in an AI-built app. These seven checks take about ten minutes. If any of them fail, fix that first, before you add new features.

1. Are secret keys in the browser?

Open your app, right-click, choose Inspect, and look at the Sources or Network tab. Search for words like “sk-“, “secret” or the name of the paid services you use. Public keys are fine. Secret keys should never show up here.

2. Is Row Level Security on?

If you use Supabase, open the Table Editor. Every table with user data should have RLS enabled. Tables without it show a warning. Supabase also has a Security Advisor that lists problems for you.

3. Can one user see another user’s data?

Create two test accounts. Add some data with the first one. Log in with the second one in a private window. If you can see the first user’s data, your database rules need work.

4. Are admin pages really protected?

Log out and try to open your admin pages directly by typing their address. Then try with a normal user account. Hiding a link in the menu is not protection. The page itself has to check who is asking.

5. Is the service role key anywhere in your code?

Search your project for “service_role”. This key skips all security rules. It belongs only on a server. If it is in your front-end code, replace it in Supabase today.

6. Do errors show too much?

Trigger an error, for example by submitting an empty form. If the page shows database details, file paths or full error messages, attackers can learn a lot from them. Users only need a short, plain message.

7. Is there a limit on expensive actions?

If your app calls a paid AI service, check what happens if one user clicks the button a thousand times. Without a limit, one person can run up your whole bill. Set spending limits with the provider at the very least.

What to do with the results

• All seven pass: good start. Repeat the check after big changes.
• One or two fail: fix those now. Our guides walk you through each one.
• Three or more fail, or you are not sure how to check: get a person to look at it. A security review of a small app is usually quick.