Security for AI-built apps and websites
Built it with an AI tool and put it live? We find what is exposed, fix what matters first, and keep it patched and watched.
AI coding tools and app builders make it possible to ship a working app, website or internal tool in a weekend. What they do not do is think about who else can reach it. The failures are rarely exotic: keys and passwords in code the browser downloads, a database that answers anyone who asks, pages that check someone is logged in but not whose data they are asking for, and no backups or logs when something goes wrong. In February 2026 researchers found a key in the front end of a social network built entirely with AI that gave anyone read and write access to its whole production database. In May 2026 a study of apps made with AI coding platforms found around 5,000 exposing sensitive data, from medical complaints to internal financial records.
Sources: Wiz Research on Moltbook, February 2026 · Security Boulevard on the RedAccess findings, May 2026
The work, named
- Keys and secrets
- API keys, passwords and tokens found wherever they have ended up, in code the browser downloads or in a public repository, moved server-side, and the exposed ones replaced.
- Database and storage rules
- Your database and file storage checked so they answer only the people they should, including the row-level rules some platforms rely on and leave switched off.
- Logins and permissions
- Every page and API route checked for who is asking, not only whether someone is logged in, with sign-up, password reset and admin areas tested the same way.
- Hosting, domain and email
- HTTPS and security headers, admin panels off the open internet, apps that should be private made private, and the SPF, DKIM and DMARC records that stop anyone sending email as you.
- Packages and updates
- Known-vulnerable packages found and updated, with a routine so they stay current.
- Backups, logs and alerts
- Backups that have been restored at least once, logs someone can read, and alerts for the failures that matter.
- UK GDPR basics
- A privacy notice that matches what the app actually collects, and the records the law expects you to keep.
- Fixes you can act on
- Settings we change ourselves. Code changes written up precisely, in plain English or as prompts for your AI tool, so you are never left with a finding you cannot fix.
Signs this is the one you need
- You built the app or site with an AI tool and nobody has reviewed it since
- It holds real users, payments or personal data
- A key, password or token has ever been pasted into the code
- A customer, an investor or an insurer has asked how it is secured
- You are about to launch, raise money or sell to larger customers
Four stages, same for every service
-
Review
The free review: what you run, what is exposed, and where the risk actually sits, written down. The document is yours regardless of what happens next.
-
Plan
A prioritised plan, sized to your business rather than pulled off a menu, with the quick wins named first.
-
Price
A fixed price in writing, with what is included named: monthly for a plan, once for a project. Nothing starts before you have seen it.
-
Revisit
The plan is revisited as the business changes, rather than left to drift out of date.
The things people ask
Do you rewrite the app?
No. Dacros is an IT and security practice, not a development studio. We review the app, change the configuration that needs changing, and write up the code fixes precisely enough that you, your developer or your AI tool can make them. If you want a website rebuilt, our sibling practice VerySEOly builds websites.
Is this a penetration test?
No, and we will not call it one. It is a security review of how the app is built, hosted and configured, which is where most of the problems in AI-built apps sit. If a customer or an insurer needs a formal penetration test, we will say so and help you scope one with a specialist firm.
Which tools and platforms do you cover?
The common AI app builders and coding assistants, such as Lovable, Bolt, Replit and Cursor, and the places their apps run: hosted databases like Supabase and Firebase, serverless hosting, and the usual payment and email services. If your setup is unusual, the review starts by finding out what it is.
Sectors with their own requirements
Related, and the rest of what we run
- AI tools at work: the security risks
- How to secure your business website
- How to write a privacy notice
- Managed IT support
- Cyber security
- Network engineering
- Telecoms and VoIP
- Data cabling
- Remote support
- PHP and WordPress security
- Backups, disaster recovery and failover
- Sectors we cover
- How pricing works
Not sure which of these you need? That is exactly what the free review is for. Book the free review.