I've spent a good chunk of the past year looking closely at apps built with AI coding tools, for founders, small teams, and people shipping their first real product. Different builders, different tools, wildly different ideas for what the app was supposed to do. The gaps I kept finding were remarkably consistent, and that consistency is the actual story worth telling here.
The pattern that kept repeating
It was almost never something exotic. It was a database with no real access restriction, reachable directly by anyone who found the right address. It was a key that ended up somewhere a browser could read it. It was a page that should have required an admin login and simply didn't check. It was safety-net settings that were never turned on because the app worked fine without them. Four categories, again and again, across apps that otherwise looked nothing alike.
Why the same four things, specifically
None of these are exotic attacks requiring rare skill to find. They're the kind of gap that shows up when a feature is built to work, tested by someone checking that it works, and shipped the moment it does, without a separate pass specifically asking who else can reach this and what happens if they try. Building fast and checking for this are two different activities, and only one of them happens by default while you're moving quickly.
What surprised me most
How rarely it was about the tool being bad. Every AI coding tool I looked at could clearly produce working, often genuinely impressive apps. The gap wasn't in what the tool could do, it was in the step that happens after building: actually checking, deliberately, from the outside, what a stranger could see or touch without an invitation. That step doesn't happen automatically no matter which tool did the building.
Where this leaves me
A year of doing this by hand, one app at a time, taught me the checks well enough to know exactly what to look for and roughly how long it takes to find it. It also taught me that doing this one app at a time doesn't scale to how many of these apps are being shipped every single day. That gap between what's needed and what one person checking by hand can actually keep up with is the problem I've been thinking hardest about lately.
More on what I've been building around that soon. For now, if any of the four things above sound familiar, they're worth checking in your own app today, not waiting for a reason to.