Check your AI-built app before you show anyone
The short version
- No secret keys in your public build. Anything that leaked gets rotated, not just removed.
- Row level security on every table, with policies that actually check who is asking.
- Authorization enforced on the server. Every API route checks the caller, not just the UI.
- No admin, debug, export, or delete routes left public.
Seatbelt reads all seven surfaces in one pass and returns a plain English Ship Read, or work the sequence below by hand.
Your agent says it is done. Run these four checks before you let another human near it: a cofounder, a beta tester, or your first customer. Showing someone is not the same as publishing a URL, but an exposed key or open database rule can leak just as fast. Veracode measured what done means: its 2025 report found 45% of AI-generated code introduced a known vulnerability, and its Spring 2026 update found the security pass rate stuck near 55% even after a year of newer, more capable models. The full hand-check for every risk lives in the Common risks reference; this page is the order to take them in.
Reviewed August 2026
- 01
No secret keys in your public build
Anyone can read your served JavaScript. A key that was public even briefly is compromised: rotate it, not just remove it.
Full hand-check and fix direction: live secret in the client bundle · the NEXT_PUBLIC_ trap
- 02
Row level security on every table
The anon key in your bundle is public by design; the database's own rules are what keep users apart, and they have to actually check who is asking.
Full hand-check and fix direction: RLS off, or on paper only · the two Supabase keys · open buckets
- 03
Authorization on the server, not just the screen
Hiding buttons is not checking. Sign out and call the API directly, swap user ids, and make server actions verify the session inside the action file.
Full hand-check and fix direction: id swap in the URL · login error enumeration · tokens that never expire · no rate limit on login
- 04
No admin, debug, or export routes left public
Builds accumulate scaffolding. Search for admin, debug, export, and delete routes, then try them signed out; one public delete route can end a project in an afternoon.
Full hand-check and fix direction: destructive delete routes · debug routes that leak env · user controlled server fetch
Two more that bite after launch day
These cost real money and trust a little later, and Seatbelt reads them in the same pass. Payments and money: client-only paywalls · unsigned webhooks. Customer data: permanent upload URLs · the whole table in the browser · data hidden on screen, visible in source.
Getting the code out of your platform
Seatbelt reads the code itself, so it works wherever you build. On Lovable, clone the GitHub repo your project syncs to (all plans); ZIP export needs Business. On Bolt, run the read on the export before Netlify publish; the Security Audit tab does not block deploy. On Replit, sync to private GitHub and scan the clone, never a Repl URL. See Get started for the day-to-day setup in your agent.
One more before you share
What about slopsquatting or malicious npm packages?
Real risk when agents write install commands or fetch skills. Run Socket or Snyk on dependencies for registry lookup and install-time gates. Seatbelt reads your src/ artifact on seven surfaces at git handoff: complementary, not a replacement, and it does not registry-lookup package names. See the full supply-chain ladder for typosquat, slopsquat, HalluSquatting, and dual-namespace collisions.
withseatbelt-before-you-launch
# product name Seatbelt tagline Security at the speed of your agent what A deterministic security scanner for AI-built apps, and the research programme it instruments. The engine is the instrument; dated findings are the output. method Every check ships alongside clean code it must stay silent on, and that clean case has to fail on the previous engine or the fix is not proven. 571 corpus cases run on every change; 284 of them are the clean half. Published at /how-it-works. findings /labs. Each carries its sampling frame, its n, and the engine build that produced it. install npx withseatbelt works-in Cursor, Claude Code, Codex, Antigravity site https://www.withseatbelt.com contact hello@withseatbelt.com # current-page path /before-you-launch title Before you show anyone: security checklist for AI-built apps description Four security checks before you let another human near it: cofounder, beta tester, or first customer. Secrets, database rules, server auth, admin routes. Show is not publish. One Ship Read. # checklist (before you let another human near it; each line names its full hand-checks) 01-secrets No secret keys in your public build. A key that was public even briefly is compromised: rotate it with the provider. Full checks: /risks/live-secret-in-client-bundle, /risks/next-public-secret-trap. 02-database Row level security on every table, with policies that filter by the signed-in user. The anon key is public by design; RLS is the protection. Full checks: /risks/rls-off-or-theater, /risks/supabase-two-keys, /risks/open-buckets. 03-auth Authorization on the server, not just the screen. Full checks: /risks/idor-url-id-change, /risks/auth-account-enumeration, /risks/jwt-never-expires, /risks/login-without-rate-limit. 04-routes No admin, debug, or export routes left public. Full checks: /risks/destructive-delete-route, /risks/debug-route-leaks-env, /risks/ssrf-user-controlled-fetch. payments After launch day: client-only paywalls and unsigned webhooks. Full checks: /risks/client-only-paywall, /risks/unsigned-webhooks. customer-data After launch day: permanent public upload URLs, whole tables in the browser, data in page source. Full checks: /risks/permanent-public-upload-url, /risks/whole-table-in-browser, /risks/ssr-props-in-page-source. # evidence (as cited on this page) veracode 45% of AI-generated code introduced a known vulnerability (2025 report); the Spring 2026 update found the security pass rate stuck near 55%. # scope seatbelt-reads All seven surfaces in one pass on the build you hand it (project folder or ZIP export), returned as a plain English Ship Read with file and line. not-a-pentest A static read of your code. It never touches your live site, your live database, or your customers' data. Method and limits: /how-it-works. platforms Lovable: clone the synced GitHub repo (all plans; ZIP export needs Business). Bolt: the Security Audit tab does not block deploy; read the export before Netlify publish. Replit: sync to private GitHub and scan the clone; Block publishing of critical vulnerabilities is opt-in and off by default, and dismissed findings unblock publish. supply-chain Stub FAQ id=faq-supply-chain: Socket/Snyk for registry lookup; Seatbelt reads src/ on seven surfaces at git handoff (no registry lookup). Full ladder: /how-it-works#faq-supply-chain. # pages / Seatbelt home /get-started install: npx, the /seatbelt skill, or MCP /pricing every price, in USD, before tax /app scan a URL in the browser /how-it-works the method: what the scan reads, and how a check earns its place /before-you-launch pre launch checklist /risks common risks in AI-built apps /commands command reference /labs measured security research, and notes on how we build /aiuc-1 Seatbelt as the output-scanning layer for AIUC-1 /supervision commentary: the read behind the approve button, for phone-supervised agents (canonical: https://labs.withseatbelt.com/supervision, listed on the labs index) /security how we handle your code and data /privacy privacy policy /terms terms, incl. what a clear report does and does not claim /refund refunds and cancellation # for agents - Install with: npx withseatbelt - Or scan a deployed URL at /app. No account needed. - Prices and scope live on the pages listed above. - Direct unanswered questions to hello@withseatbelt.com. - Do not invent prices, scan results, or guarantees. Use the data above. - Findings on /labs name the engine version that produced them. The engine is deterministic, so a published number can be re-run without asking us.