AI coding tools are genuinely remarkable. A non-engineer can now describe an app and watch it appear, working, in an afternoon. The catch is that 'working' and 'safe' are different properties, and the tools are far better at the first than the second. An app can pass every demo and still expose customer data to anyone who thinks to look.

You do not need to be technical to notice the warning signs. Here are seven that mean the app you shipped deserves a proper security read before it does any more of the business's real work.

1. Nobody has read every line

This is the root of all the others. If the app was assembled through prompts, feature by feature, and no single person has actually read the whole thing with a critical eye, then nobody knows what is really in it. The assistant optimized for making your feature work — not for the questions you did not think to ask. An unread codebase running real operations is the single clearest signal an audit is overdue.

2. It handles logins, payments, or personal data

The stakes scale with what the app touches. If it authenticates users, processes payments, or stores anything personal, the cost of a quiet flaw goes from embarrassing to serious — regulatory exposure, financial loss, a breach notification. AI tools routinely get the happy path right and the security-critical edges wrong, and those edges are exactly where money and personal data live.

3. You are not sure whether your data is actually protected

Many modern apps rely on database-level rules to keep one user from seeing another's data. Those rules are easy to assume and easy to get wrong — the app looks correct because the interface only ever asks for your own data, while the underlying API happily returns anyone's if hit directly. If you cannot say with confidence that the protection holds when someone bypasses the interface, assume it might not.

4. There might be secrets in the code

API keys, tokens, and passwords are supposed to stay on the server, never in the code that runs in a visitor's browser and never committed to the repository. AI-assisted builds frequently leak them into both. A single exposed key can let a stranger run up your bill, read your data, or impersonate your app. If you are not certain none have leaked, that uncertainty is itself the finding.

5. You don't know what it depends on

Modern apps are built on stacks of third-party packages, and any one of them can carry a known vulnerability. Assistants pull dependencies in freely and rarely tell you what came along. If nobody has audited the dependency tree against known-vulnerability databases, you are trusting code you have never inventoried, let alone vetted.

6. It grew far beyond what it started as

A weekend prototype that quietly became the system running your operations is a classic risk profile. The security assumptions that were fine for a toy — no real users, no real data — silently became inadequate as the app took on real weight, and nobody stopped to re-examine them. Scope crept; the security posture did not keep up.

7. It's now load-bearing for the business

The simplest test: if this app broke or was breached tomorrow, would it hurt? If the answer is yes — lost revenue, exposed customers, halted operations — then it has crossed from experiment into infrastructure, and infrastructure deserves to be audited by someone who reads it the way an attacker would. The more the business depends on it, the less you can afford not to know what is inside.

If several of these ring true, that is what our AI-built codebase audit is for: a fixed-price, written read of exactly what you shipped — the exposed secrets, the missing checks, the risky dependencies — ranked by severity, with a remediation plan you can act on.

Talk to a senior engineer More resources

Seven signs your AI-built app needs a security audit