Production reality check
Your AI app passed the demo. Did it pass an attacker?
Security review is not asking the agent whether the code looks secure. It is tracing who can do what, with which data, across every trust boundary.
01
What happened?
Generated applications often assemble familiar components correctly in isolation while missing system-level policy: server-only secrets reach the client, record ownership is not enforced, or an admin action relies on hidden UI instead of authorization.
02
Why this happens
- Secrets or privileged keys are bundled into browser code or logs.
- Authentication exists, but object-level authorization is missing.
- Uploads, prompts, webhooks and redirects accept untrusted input without constraints.
- Dependencies, headers, cookies and production debug settings are not reviewed.
03
What you can check yourself
- Map users, roles, resources and allowed actions; test forbidden actions directly.
- Search source, build artifacts and history for secrets, then rotate exposed values.
- Validate input on the server and restrict outbound requests, uploads and redirects.
- Check dependency advisories, secure cookie flags, CSP and error handling.
04
How to test the fix safely
Apply security fixes to a dedicated version, run automated checks, exercise abuse cases in staging and confirm logs do not leak sensitive values. Deploy with monitoring and a rollback decision prepared.
05
When you need a developer
Use a qualified reviewer when the app handles personal data, payments, privileged integrations or multi-tenant data. Shipvise can add AI or senior review to a controlled release workflow; it does not turn an untested app into a certified system.
FAQ
Questions people ask after the demo stops working
Is vibe coding safe?
It can be used safely when scope, data sensitivity and controls are understood. Unreviewed generated code should not be trusted merely because the demo works.
Can an automated scan prove the app is secure?
No. Scans find classes of issues, but authorization, business logic and operational exposure require context and often manual testing.
What is the first security check?
Verify that no secret or privileged API key is sent to the browser, then test whether one user can access or change another user’s records.