The most common flaws in AI-built apps

The flaws in an AI-built app look a lot alike, because they come from the same oversights: what must work got built, what must hold up did not. Here is the catalogue of the most common ones, each explained in a sentence with a way to spot it.

The building and its weak points

Think of an apartment block's front: a window left ajar, a key under the doormat, a service door never locked. None is spectacular, but one is enough to get in. An app works the same way.

The eight typical flaws

1. Data readable by everyone. The database does not check who may read what. A logged-in user can then see another person's information. It is one of the most frequent, and one of the most consequential. See database access rules.
2. Keys visible in the code. An access key for a third-party service (payment, email, AI) ends up in the part of the code sent to the browser, so anyone can read it. See exposed API keys.
3. Checks done only on screen. A "delete" button is hidden from ordinary users, but the server accepts the request from anyone. Hiding is not forbidding: the check must happen on the server.
4. Poorly protected admin pages. The back-office address is guessable, and nothing requires you to be an administrator to open it.
5. Inputs taken at face value. A text field accepts anything, including malicious code. Depending on the case, this opens the door to attacks such as SQL injection or XSS.
6. No limit on requests. Nothing stops someone from trying a thousand passwords a minute, or from blowing up your bill on a paid service. That is the job of rate limiting.
7. Error messages that say too much. When something goes wrong, the app displays technical details useful to an attacker: table names, paths, versions.
8. Components never updated. The code relies on ready-made libraries. If one has a known, fixed flaw but nobody updates it, the flaw stays open.

Why AI lets them through

The tool answers your request, rarely what you did not ask. If you write "show the list of orders", it shows the list of orders. It does not always ask "whose are they?". And when the result works on screen, nothing alerts anyone: a flaw makes no noise until someone exploits it.

Another difficulty: these flaws are invisible in normal use. You will not run into them by testing your app like a customer. You have to try on purpose to get around it.

How to spot them yourself

With no technical skill, three habits are worth it:

• open two test accounts and check they are properly separated;
• try the address of a private page once signed out;
• look, with someone who can read code, for keys appearing in it.

Beyond that, an outside review is more effective, because it follows a method: it goes through each category instead of stumbling on problems at random.

For the big picture, start with is my AI-built app secure?.

Remember

The flaws in an AI-built app mostly come from oversights, not clever mistakes: data access, visible keys, missing checks. Each can be fixed, provided it is looked for.

And for your product?

An audit goes through your app on these categories and hands back an ordered list: what is urgent, what can wait. If you want to know where you stand, we can talk it through in a 30-minute call.