The Data
What we actually find, across 1,236 scanned apps.
We have scanned 1,236 AI-built apps and logged 12,205 findings. Twenty-one came back clean. This is what the rest looked like: the patterns that repeat, the exposures that matter most, and the handful of cases that still stand out.
The findings are consistent enough to predict.
Across more than a thousand apps, the serious problems are not random. They cluster into a short list of failures that AI builders make again and again, almost always around access control. That consistency is why an audit is worth doing: we know where to look, because the same gaps appear in app after app, behind interfaces that all work perfectly.
Broken access control leads by a wide margin
The most common serious finding, by far, is broken access control: data that anyone can reach because no rule decides who may. On Supabase apps it is a table with no row-level security behind the public anon key. On Firebase apps it is a database left in test mode, wide open from the root. In both cases the public key that is meant to be shared reaches data that is not, and the app behaves normally the entire time.
The exposures this produces are not abstract. A lending product with a table of full bank account numbers readable by anyone with the public key. A health app exposing patient access codes and payment codes the same way. An education platform exposing its users' stored Google authentication tokens, enough to access those accounts elsewhere. Private in intent, public in fact.
Writable data and privileged functions
Reading is the milder version. In many apps the same tables could also be written to by unauthenticated strangers: tables named orders, payments and transactions where an outsider could insert a forged record the app would treat as real. In one app, a table named security_events, the audit log meant to record suspicious activity, was itself writable by anyone, so an attacker could overwrite the record of their own actions.
The same failure extends to database functions. We have found privileged functions left callable with the public key, including ones named generate_license_key and generate_transfer_token. A stranger could call these directly and have the database mint a valid licence or transfer token for them.
Exposed secrets and misconfiguration
Beyond access control, the recurring findings are secrets that should never have shipped to the browser, and platform settings left at their wide-open defaults. Storage buckets open to anonymous uploads, so a stranger could place files of their choosing into the app's own storage. Service-role keys and other true secrets sitting in client code where anyone can read them. None of it visible from the outside; all of it visible to someone using the public key the way an attacker would.
And the 21 that were clean
Twenty-one of the 1,236 apps came back with nothing serious. It is possible to build a secure app on these tools; it just does not happen by default. The clean apps had someone who thought about access control deliberately, which is exactly the thing a fast build skips. An audit is how you become one of the 21, or confirm that you already are.
Common questions.
- Where do these numbers come from?
- From our own scanning of AI-built apps: 1,236 apps scanned, 12,205 findings logged, 21 apps clean. The patterns described here are what those findings consistently show, and the specific cases are real, anonymised to their sector.
- Is my app likely to have these problems?
- If it was built quickly on an AI builder and nobody deliberately checked access control, the odds are not in your favour: only 21 of 1,236 came back clean. The good news is that the common findings are well understood and fixable, which is what an audit is for.
- How do I find out what mine has?
- A security audit checks your app against exactly these patterns and hands you a prioritised list of what to fix. You can request one and know within about a week.
Related services.
Let's build something real.
Tell us about your app or idea. You'll get a clear plan and a fixed quote back within 24 hours.