## Why AI Code Generators Introduce Recurring Vulnerabilities When developers prompt large language models with instructions like *"Build me a SaaS dashboard with user login and Stripe billing,"* the AI prioritizes generating compact, immediately working snippets. In doing so, it frequently omits defensive engineering layers that require additional architectural setup. Here are the **seven most critical security risks** found in AI-generated web applications today. --- ### 1. Client-Side Only Authentication Guards AI models frequently implement route protection by checking user state inside React client components: ```tsx // VULNERABLE: Client-only guard export default function AdminPage() { const { user } = useAuth(); if (!user?.isAdmin) return <p>Access Denied</p>; return <SecretAdminDashboard />; } ``` **The Risk:** Any visitor can inspect network requests or disable JavaScript to access underlying API endpoints if backend route handlers do not enforce server-side session authorization. --- ### 2. Missing Row-Level Security (RLS) When connecting to PostgreSQL, Supabase, or Firebase, AI prompts usually generate queries that execute with service role privileges or leave database tables completely open without explicit RLS policies. **The Fix:** Always verify that every database table has RLS enabled with granular policy checks. --- ### 3. Exposed Secrets and Client Bundle Leakage A frequent AI mistake is referencing server secrets in client components: ```tsx // SECURE: Initialize private SDKs in server-side routes using process.env import Stripe from 'stripe'; const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!); ``` Never prefix private API keys with public bundling flags. Store secrets exclusively in server environment variables. --- ### 4. Permissive CORS & Missing Rate Limits AI templates rarely configure rate limiting on public `/api/generate` or `/api/auth` endpoints, leaving your application vulnerable to scraping, brute-force attacks, and AI token exhaustion. --- ### 5. Unsanitized Dynamic SQL Queries Even when using modern ORMs, AI models sometimes resort to raw SQL templates with string interpolation: ```typescript // VULNERABLE: Direct string interpolation in query const result = await db.execute(sql`SELECT * FROM users WHERE email = '${userEmail}'`); ``` Always use parameterized queries and ORM schema helpers. --- ### 6. Client-Controlled Payment Amounts When integrating payment providers like Stripe or PayPal, generated code frequently reads the pricing amount from client request payloads: ```typescript // DANGEROUS: Client controls price const session = await stripe.checkout.sessions.create({ line_items: [{ price_data: { unit_amount: req.body.amount } }] }); ``` **The Fix:** Look up product prices server-side from your database or Stripe Price ID catalog based on plan ID. --- ### 7. Unhandled Promise Rejections & Verbose Stack Traces In production mode, unhandled API errors often leak complete database schemas, file system paths, and internal server credentials in JSON error responses.

7 Security Risks in AI-Generated Applications

Find vulnerabilities in your AI application

Practical Implementation Checklist

1. Audit All 'use client' Files for Private Keys

2. Verify Server-Side Price Verification

3. Restrict CORS Wildcards on Sensitive APIs

4. Enable Row-Level Security on PostgreSQL / Supabase

Related Engineering Guides

How to Audit AI-Generated Code Before Production

Environment Variables vs Hardcoded Secrets

AI-Generated Code Security Checklist

Audit your AI project before launch