Launching an app built with AI? The security checklist
AI coding tools are good at making features work and less reliable at the parts nobody sees: who is allowed to do what, which secrets reach the browser, and what happens when someone calls your API directly. This checklist covers the problems found most often in Next.js and Node apps written with Cursor, Bolt, Replit, v0 or Claude Code.
- Updated
- October 5, 2026
- Written by
- Nitya Hoyos
- Checks
- 7, each with a fix
- You need
- A browser and a terminal
(01)Why it matters
The most common serious bug in AI-written backends is missing authorization: an API route or server action checks that someone is logged in, but not that the record they ask for is theirs. Change the ID in the request and you get another user’s data. It never shows up when you click through your own app, which is why it survives to production.
The next most common are secrets in the wrong place and trust in the browser. Environment variables with a public prefix are compiled into the JavaScript bundle. Prices, roles and payment status sent from the browser can be edited by the user. Webhooks accepted without checking their signature can be faked.
The rest of the list is about running the app for real: rate limits on logins and expensive endpoints, dependencies with known vulnerabilities, backups you have restored at least once, and error monitoring so you hear about failures before your users tell you.
(02)The checks
Run these before launch
- 01
Every route checks ownership, not just login
How to check
For each API route and server action that reads or changes a record, change the record ID in the request to one belonging to another test user. You should get a 403 or 404, not their data.
Fix
Look up the record with both its ID and the current user’s ID (or organization), on the server, in every handler.
- 02
Server actions are treated as public endpoints
How to check
In Next.js, every exported server action can be called directly, not only from the form that uses it. Check each one for its own authentication and authorization.
Fix
Start every server action by reading the session and checking permissions, the same as an API route.
- 03
No secrets in the browser or the repo
How to check
Search for keys in variables prefixed NEXT_PUBLIC_ or VITE_, in the built JavaScript, and in git history (git log -p | grep -i "sk_live\|secret\|password").
Fix
Keep secrets in server-only environment variables; rotate anything that was committed or shipped, since removing it from the code does not remove it from history.
- 04
Stripe webhooks are verified and prices come from the server
How to check
Check that the webhook handler verifies the Stripe-Signature header against the raw request body, and that checkout sessions are created with price IDs chosen on the server.
Fix
Use stripe.webhooks.constructEvent with the raw body and your webhook secret; never accept an amount or price from the client.
- 05
Logins and expensive endpoints are rate limited
How to check
Send the same login, password reset or AI request 100 times in a minute. If nothing slows you down, nothing slows an attacker down either.
Fix
Add rate limits per IP and per user, and spending caps at the AI or email provider.
- 06
Input is validated on the server
How to check
Send unexpected types, very long strings and extra fields to your API. Look for errors that leak stack traces, and for fields like role or isAdmin that get saved because the handler spreads the whole body into the database.
Fix
Validate request bodies against a schema and copy only the fields you expect.
- 07
Dependencies, backups and monitoring
How to check
Run npm audit, check that database backups are on, try restoring one, and confirm errors in production reach you.
Fix
Update or replace vulnerable packages, schedule backups with a tested restore, and add error monitoring before launch.
(03)Beyond the checklist
When to get help
If the app handles payments, personal or health data, or other companies’ data, or you are raising money or selling the business, have the code reviewed by someone who did not write it, or prompt it.
(04)Questions
Is code written by Cursor or Claude Code secure?
It is as secure as the review it gets. AI tools write working code quickly, but they follow your prompts, and authorization, secrets handling and abuse limits are easy to leave out of a prompt. Treat AI-written code like code from a fast new hire: review it before it handles real users.
What is the most common security bug in AI-built apps?
Missing authorization: endpoints that check a user is logged in but not that the requested record belongs to them, so changing an ID in the request exposes other users’ data.
Can I use AI to fix the security issues?
Often, yes, once you know exactly what is wrong and where. The hard part is finding the issues; a clear list with file and line lets you or the AI fix them reliably.
Want someone else to run these checks?
The AI-Built App Audit covers everything on this page and more, in 5 business days, with the file and line for each issue. $750 flat.