The question I keep getting asked
A founder messages me almost every week with some version of the same worry. They built their app with an AI tool, it works, people can sign up, but they've never opened the code and wouldn't know what they were looking at if they did. Then comes the real question: how do I know if this thing is actually safe before I put it in front of real customers and their real information?
That worry is reasonable, not a personal failing. Plenty of good products got launched in the last year or two by people who could describe exactly what the app should do but had no way to check whether it was built safely underneath. The good news is you don't need to learn to read code to get a straight answer. You need to know what to ask, and what a real answer sounds like.
You're not checking the code. You're checking the answers.
A security check, at the level a non-technical founder actually needs, isn't about opening files. It's about asking a developer or a reviewer a handful of plain questions and paying attention to whether the answer is specific or vague. A specific answer names something they actually looked at and how. A vague answer just reassures you with a feeling instead of a fact.
Five questions worth asking before you launch
- If I log into my own account, then change a number or ID in the web address bar, can I see someone else's information? A safe app says no on every single page, not just the obvious ones. This one mistake, letting one user peek at another user's data, has been one of the most common flaws in apps built quickly with AI tools over the past year or so.
- Where do passwords, keys, and other secret codes live? They should never be typed directly into the app's code where anyone poking around could find them. They belong somewhere separate and locked down that only the running app itself can reach.
- Can someone create or get into an account that isn't theirs using nothing but a link or an ID they can guess? Ask this one directly, out loud. It's exactly the kind of gap that let outsiders slip into other people's private projects on more than one popular AI-built platform last year, before it got caught and fixed.
- Has a second person, someone other than whoever built it, actually looked at this before it went live? Not glanced at it. Tested it.
- If the AI tool made a change on its own, did a person read that change before it shipped, or did it just go out the door?
What a real answer sounds like
Someone who's done the work answers in specifics: 'yes, I checked that every user can only reach their own data, here's how I tested it,' or 'keys are kept in a locked settings area, never typed into the code itself.' Someone who hasn't done the work tends to answer in feelings: 'it should be fine,' 'we haven't had any issues,' 'AI tools are pretty good about this now.' None of those are wrong exactly. None of them are answers either. You don't need to understand every technical word in a good answer. You just need to notice that there's something specific underneath it instead of a comforting shrug.
One of the bigger stories from last year involved a well-known AI app builder whose database privacy setting was, by default, backwards on a huge number of live projects, more than a hundred and seventy of them once researchers went looking. Nobody had done anything malicious to cause it. The setting had simply never been checked before real users started signing up.
You don't have to become a security expert to launch something safely. You just have to stop accepting comfort as an answer, and keep asking these same five questions again every time something meaningful changes, not just once before launch.