Your result

Almost there

Your app works. A few things underneath it don't yet.

Work through your fix list below. Paste each prompt into your AI, using your own app, and read the answer. When you can say yes to all ten, run the full security check.

Your fix list

Paste each prompt into the AI you build with (Claude, Cursor, Lovable, Bolt…) and read what it tells you about your own app.

1. Your data

   This is the shape of your database. If you don't define it, AI guesses, and the guess gets built into everything. One of my builds treated a small group as if it were a whole division of the organization: right code, wrong idea.

   Ask your AI

   Describe the data model you built: every table, what it stores, and how the tables connect. Flag anything you assumed instead of being told.

   Copy prompt
   Go deeper: What my design skills were for when AI wrote the code →
2. Accounts

   Accounts are a lifecycle, not a sign-up screen. The App Store rejected my walking game partly because there was no way to delete an account.

   Ask your AI

   Walk me through every account flow in this app: sign up, sign in, forgot password, sign out, delete account. Which ones are missing or only half built?

   Copy prompt
   Go deeper: Shipping a game to the App Store with AI agents →
3. Permissions

   A hidden button isn't a lock. Anyone who knows how apps talk to servers can skip the screen. My app once kept people out of private groups only by hiding the button.

   Ask your AI

   For every piece of private data, show me where the server checks who is allowed to read or change it. List anything that is only protected by hiding it in the UI.

   Copy prompt
   Go deeper: The ten systems under every AI-built app →
4. Database rules

   Many AI app builders put your data in a database that anyone with your app's public key can query. The rules are the only thing standing between strangers and your users' data. Apps have leaked thousands of records because one setting was off.

   Ask your AI

   List every table in my database and whether access rules (row-level security or security rules) are enabled on it. For each one, explain in plain English who can read and write it.

   Copy prompt
   Go deeper: The ten systems under every AI-built app →
5. Secret keys

   Anything in the front end can be read by anyone who opens your app. Secret keys belong on the server, stored as environment variables, never in code people can see.

   Ask your AI

   Search this project for API keys, secret keys, tokens and passwords. Tell me which ones are exposed in front-end code or committed to the repo, and how to move them to environment variables on the server.

   Copy prompt
   Go deeper: The ten systems under every AI-built app →
6. When things break

   AI builds the happy path by default. The half-finished cases only get handled if someone asks, and they're the ones that cost money and trust.

   Ask your AI

   For each important action in this app (sign up, save, pay, upload), what happens if it fails halfway through? Show me where each failure is handled and what the person sees.

   Copy prompt
   Go deeper: The ten systems under every AI-built app →
7. What leaves your app

   These leave your system the instant they fire, and deleting data afterward doesn't take them back. My app's automated tests cleaned up the database perfectly, and had already sent notifications to real people's phones.

   Ask your AI

   List everything this app sends outside itself: emails, push notifications, texts, payments, webhooks. For each one, how do I test it without reaching a real person or charging a real card?

   Copy prompt
   Go deeper: The ten systems under every AI-built app →
8. Uploads

   Uploads usually live separately from the rest of your data, with their own limits, costs and privacy rules. A private group's photos need to be as private as its messages.

   Ask your AI

   Where are uploaded files stored? What are the size and type limits? Who can open a file if they have its link, and is that checked on the server?

   Copy prompt
   Go deeper: The ten systems under every AI-built app →
9. Hosting and cost

   Speed lives on a real machine. My app once took 15 to 30 seconds to load messages while the database query took 79 milliseconds: the server had run out of borrowed processing power. Upgrading my plan didn't upgrade the machine.

   Ask your AI

   What services does this app run on, what does each cost per month at my current usage, and what are the limits? What breaks first if usage goes up ten times?

   Copy prompt
   Go deeper: The ten systems under every AI-built app →
10. Knowing when it breaks

    Check the thing that matters. On one side project my alert only checked that the server was on, and the product was dead for three weeks before anyone noticed. Keys expire too, and when one does, everything stops at once.

    Ask your AI

    How would I find out if this app stopped working right now? Set up error alerts that check what users actually experience, and list any keys or certificates that will expire.

    Copy prompt
    Go deeper: The ten systems under every AI-built app →

Your next step