AI writes your code. Who checks it?

In 2026, building software has never been easier. I see it every day: an interface, a database and online payments can be ready in a few hours with a coding assistant. It is a real revolution for entrepreneurs, and I won't pretend otherwise.

But there is a blind spot. AI produces code that works on screen. Security doesn't show on screen. It only shows the day someone comes looking for what you left open.

170 applications left wide open

The most telling case is the flaw catalogued as CVE-2025-48757: 170 apps built with Lovable let anyone read their data. Lovable itself wasn't to blame. The generated Supabase databases simply had no Row Level Security rules, or rules that let everything through.

In Supabase, the "anon" key is public, and that's expected. RLS rules decide what it can do. Without them, that key is enough to read your users, orders or messages tables.

The mistakes I see most often

• Secret keys in the browser. NEXT_PUBLIC_ and VITE_ mean public: anything with that prefix ships in the JavaScript sent to visitors.
• Tables without RLS, or with a "using (true)" policy that allows everyone.
• Vulnerable dependencies installed without checking their age or reputation.
• API routes without access control, because the interface never displayed them.

Three habits to adopt today

First, keep every secret key on the server: the browser calls your API, and your API calls OpenAI or Stripe. If a key has already leaked, revoke it; removing it from the code is not enough. Second, check RLS on every table before going live. Third, have your code reviewed by someone, or something, that didn't write it.

That's why I built Citadel: it analyses an application's code, or its live address, and returns in minutes a list of vulnerabilities ranked by severity, with the fix to apply. AI speeds up building. Checking remains our responsibility.