Last updated 22 October 2026
1. Users can only see their own data
This is the most common gap in AI-built apps. On Supabase, every table that holds user data needs Row Level Security switched on, with policies that check the signed-in user. On Firebase, no rule should read "allow read, write: if true".
Quick test: sign in as one user, then change an ID in the address bar or the request to another user's record. If anything loads, other people's data is exposed.
2. No secret keys in the browser
Open your live site, press F12, and search the page source and network requests for "sk_", "sk-", "service_role" and "secret". Publishable keys are meant to be public. Secret keys for Stripe, OpenAI or your database admin role belong on the server only, and any that leaked should be rotated.
3. Paid features are checked on the server
Hiding a button from free users is not protection. Anyone can call the same request directly. The check for whether a user has paid, or is an admin, has to run on the server before the work is done.
4. Limits on sign-ups and AI usage
Without limits, one script can create thousands of accounts or call your AI feature in a loop and run up the bill overnight.
- Email verification and a CAPTCHA on sign-up.
- Rate limits on login, password reset and any AI endpoint.
- A per-user cap on AI calls, and billing alerts on your AI and hosting accounts.
5. Payments are confirmed by webhook
Don't unlock a plan because the user landed on a success page after checkout. That page can be visited directly. Confirm payment from Stripe's webhook, and verify the webhook signature.
6. File uploads are locked down
Storage buckets that hold user files should be private, with access checked per user. Limit file types and sizes, and never serve uploaded files from your main domain as if they were your own pages.
7. Errors don't leak details
Error messages shown to users should never include stack traces, database queries or environment variables. Check that your logs don't store passwords, tokens or full card details either.
8. Backups you have actually restored
Turn on automatic database backups, and restore one into a test project at least once. A backup nobody has tested is a guess.
9. Every account is in your name
The domain, hosting, database, payment processor and code repository should all be owned by your company, with two-factor authentication on, not sitting in a freelancer's or a friend's account.
10. Your privacy policy matches what the app does
A generated privacy policy is a starting point. It should name the data you actually collect, the services that process it (hosting, analytics, AI providers, payments) and how a user can ask for their data to be deleted.
Want a second pair of eyes?
The IDE Digital AI App Audit covers all ten of these and the rest of what tends to break when real users arrive. It is a fixed $1,000, takes 5 business days, and ends with a plain-English report and a prioritized fix list.