Common risks in AI-built apps
Plain-English explainers for the mistakes that actually leak data in AI-built apps. Each entry names a real incident, says honestly what Seatbelt reads from your repo, and gives you a hand-check if you want to verify before you share the link.
Started July 20, 2026. More entries ship over time.
Code execution
- A shell command built from user inputRequest text pasted into a shell command runs whatever a visitor types. One crafted field and it is their server now.Seatbelt flags automatically
- Deserializing data a stranger controlspickle, Marshal, unserialize and unsafe yaml.load run code while rebuilding objects. Request bytes in, attacker code out.Seatbelt flags automatically
- eval in app code: one input away from code executioneval runs whatever string reaches it. If any user input can get there, that is remote code execution.Seatbelt flags part of this
- User input in the template source, not the dataServer template engines evaluate their template source. Input that becomes the source instead of a variable runs on your server.Seatbelt flags part of this
- A repo that runs code the moment you open itCommitted editor and agent hooks execute a command on folder open, before you read a line. Clones carry the hook with them.Seatbelt flags automatically
Login and accounts
- Change the number in the URL, read someone else's recordLogged in is not allowed. If /api/users/123 returns any user's row, changing the ID leaks everyone.Seatbelt flags part of this
- Different login errors tell attackers which emails existDifferent messages for unknown email vs wrong password confirm which addresses are registered.Seatbelt flags automatically
- A login token that never expiresA bare jwt.sign with no expiry mints a credential that never dies. Stolen once is stolen forever.Seatbelt flags automatically
- Login routes with no rate limitbcrypt and JWT sign-in with no throttle in front: brute-force and sign-up spam at wire speed.Seatbelt flags part of this
Payments and money
- Webhooks that don't check who's callingSkip Stripe signature verification and anyone can POST fake payment succeeded to unlock paid features.Seatbelt flags automatically
- A paywall the browser enforces and the server ignoresA localStorage quota counter before a paid model route is theater. Anyone can POST directly and spend your bill.Seatbelt flags part of this
Secret keys
- A live secret key in the code your app sends every visitorAnyone can read your served JavaScript. A pasted sk_live_ is a working key in a stranger's hands.Seatbelt flags automatically
- The NEXT_PUBLIC_ trapThat prefix means put this in everyone's browser. Name a server secret NEXT_PUBLIC_… and the build tool obeys.Seatbelt flags part of this
- The two Supabase keys: one belongs in the browser, one is the master keyAnon/sb_publishable_ is public by design. service_role/sb_secret_ bypasses every rule. Mix them up and your database is wide open.Seatbelt flags automatically
Customer data
- View Source shows the data you deleted from the screenNext.js serializes server props into the HTML. Hiding a field in React does not remove it from page source.Seatbelt flags part of this
- The whole customer table, sent to the browserThe API returns every row and the UI filters client-side. DevTools Network shows all of it.Seatbelt flags part of this
- The upload URL that never stops workingFirebase getDownloadURL mints a permanent public signed URL that bypasses Storage rules. Minted once is public forever.Seatbelt flags automatically
Databases and storage
- RLS off, or on paper onlyRow Level Security decides which rows each user may touch. USING (true) protects nothing.Seatbelt flags part of this
- Open buckets: the folder the whole internet can readStorage defaults to public and nobody changes it. Verification selfies and private files become anyone's download.Seatbelt flags automatically
- SQL glued together from user inputUnsafe raw SQL and string-built queries let strangers rewrite your database queries.Seatbelt flags automatically
Risky shortcuts
- The demo works; security often does notAgents hit the functional goal far more often than a secure one. Working in a demo is not safe to share.Seatbelt flags part of this
- One URL that wipes your whole databaseA leftover reset or wipe endpoint lets anyone erase every row with one request. Demo scaffolding that ships is a ship killer.Seatbelt flags automatically
- Debug routes that dump your secrets to strangers/api/debug or /swagger returning process.env hands attackers your keys in one JSON response.Seatbelt flags part of this
- Link previews that fetch internal URLs for attackersUser-controlled server fetch turns your app into a tunnel to cloud metadata, localhost, and private VPC addresses.Seatbelt flags automatically
Want the method behind every flag? Read how Seatbelt scans, or the checklist worth doing by hand before you launch.