I look at a lot of apps built with AI coding tools, through this blog, through casual conversations, through the occasional favor for a friend. Something's shifted since January that's worth naming, separate from any single incident or tool release: the apps themselves have gotten more ambitious, not just more numerous.
What 'more ambitious' actually looks like
Back in January, most of what I saw fit a familiar shape: a solo builder's side project, a small internal tool, a simple booking or tracking app. What I'm seeing now includes real payment flows handling actual money, multi-tenant setups serving multiple paying business customers, and features, an AI assistant embedded in the product, an integration touching several other services at once, that would have felt like a bigger technical lift to attempt solo a year ago.
Why this matters more than the raw growth number does
More apps existing is one thing. The same handful of mistakes at a bigger average stake per app is a different, more consequential thing. A missing access rule on a todo list app is embarrassing. The same missing access rule on an app now processing real payments for multiple business customers is a fundamentally bigger incident, even though the underlying mistake, and the underlying fix, is identical in both cases.
Why the checks haven't kept pace with the ambition
The security habits I see, when I see them at all, don't seem to have scaled up alongside what people are actually attempting to build. A builder confident enough to wire up real payment processing and multi-tenant architecture solo is often applying the same casual, untested confidence to the security side that would have been low-stakes on a simple side project and is a genuinely different bet on something handling real money and multiple businesses' data.
What I'd actually want builders to internalize right now
The checklist doesn't change based on how impressive or ambitious what you're building is. Cross-account data tests, admin route checks, key handling, database rule reviews, all of it applies exactly as much to a payment-processing multi-tenant SaaS as it did to January's simple todo app. What changes is the cost of skipping it. As the apps I'm seeing get more capable, the gap between "felt fine to skip" and "actually mattered" gets narrower and more expensive, and that gap is exactly where I'd want more attention going, right alongside the ambition that's clearly already there.