← Blog
7 August 2026·Security · AI pitfalls
Security review before you invite users to an AI product
The launch blockers that show up after vibe coding: exposed keys, open tables, IDOR, and missing rate limits. A practical pre-launch checklist.
If an AI agent wrote your backend, assume it also left the doors unlocked.
High-frequency issues
- API keys in client bundles or git history
- Database tables without row-level security
- Insecure direct object references (IDOR)
- Missing rate limits on AI endpoints (cost bombs)
- Webhooks that trust unsigned payloads
- Admin routes protected only by obscurity
A minimal pre-launch pass
- Secret scan + rotate anything that ever leaked
- Auth matrix: who can read/write what
- Money path: signup → pay → cancel → access revoke
- AI path: prompt injection + cost controls
- Dependency audit on critical packages
We run this as part of Proof in every AppTime engagement — and as a dedicated security remediation service.
Need this done for your product?
Cite waitlist, SaaS rescue, agents, extensions, or a security pass — tell us what you are building.
Contact AppTime