What a human review
actually changes.

Ten failures we find again and again in applications built with AI coding tools. For each one: the code as the tool wrote it, the code as it should be, and how to check your own project in a couple of minutes.

Every example is illustrative and written for this page. We never publish client code.

6 critical 4 high Lovable · Bolt · Cursor · Replit · Claude Code · v0

Critical — fix these first

Critical findings

Each of these can be exploited by someone with no special access and no tooling beyond a browser.

CRITICAL

Payments

Stripe webhook accepts unverified events

Your webhook route reads the request body and acts on it directly.

Read the fix
CRITICAL

Database & data

Supabase Row Level Security is off, or has no policy

Your app works, and the Supabase dashboard shows "RLS disabled" or "No policies" next to your tables.

Read the fix
CRITICAL

Exposed credentials

Secret keys shipped to the browser

You have an environment variable named something like NEXT_PUBLIC_OPENAI_API_KEY or VITE_STRIPE_SECRET_KEY.

Read the fix
CRITICAL

Authentication & access

Admin routes protected only by hiding the button

Your admin area is protected by something like {user.isAdmin && <AdminPanel />}.

Read the fix
CRITICAL

Authentication & access

Records fetched by ID with no ownership check (IDOR)

Endpoints look like findUnique({ where: { id } }) with the ID taken straight from the URL.

Read the fix
CRITICAL

Payments

Prices sent from the browser to the checkout

Your create-checkout endpoint accepts amount, price or total in the request body.

Read the fix

High — fix these next

High-severity findings

Not immediately exploitable, but they are what turns a working prototype into an application nobody can safely operate.

HIGH

Input validation

File uploads with no type, size or ownership checks

Your upload handler takes file.name and file.type and saves the file.

Read the fix
HIGH

Performance & cost

Queries with no index, and the N+1 that follows

Pages that were instant during development take seconds in production, and get slower every week.

Read the fix
HIGH

Production readiness

Errors caught, logged to nowhere, and swallowed

Your codebase is full of catch (e) { console.error(e) } and you have no error tracking service.

Read the fix
HIGH

Authentication & access

CORS set to allow everything, with credentials on

You have app.use(cors()) or an origin reflected from the request header, plus cookie-based sessions.

Read the fix

Not sure which of these you have?

That is what the free health check is for. Send us the repository and a senior engineer will tell you which of these are in your project, where, and what to fix first.

Get my free health check