A working demo is not a safe app.
Direct answer
Before sharing an AI-built app, check that users must sign in where needed, that each user can only access their own data, that no secret keys are in front-end code or the repository, that database rules are restrictive, that inputs are validated and that dependencies are known and updated.
Checklist
- Authentication works and cannot be bypassed.
- Authorisation: users see only their own records.
- Database rules: no public read or write unless intended.
- Secrets live in environment variables on the server.
- Input validation on the server.
- HTTPS everywhere.
- Dependencies reviewed and up to date.
- Error messages do not leak internals.
- Backups and a way to delete user data.
- Privacy policy if you collect personal data.
Test like an attacker
Try to access another user's data by changing an ID in the address, and try sending unexpected input.
Where Teyro fits
Teyro's Vibe Coding: Build Apps with AI course turns this into short lessons you can play in a few minutes a day. It has 80 lessons, and you can start free.
The bottom line
Ask for a security review before putting real data in an AI-built app.
