Why AI-generated apps need their own check
AI builders ship working features fast, but they often leave defaults in place: tables readable without login, service keys in front-end code, admin routes without checks, or permissive CORS. These problems are invisible in the interface and only appear when someone queries the app directly.
What Hackaiz checks
- Website and API: security headers, exposed files, routes answering without a session.
- Data: Supabase / Postgres access rules (RLS), public storage, anonymous queries.
- Secrets: keys and tokens visible in the browser bundle or in the repository.
- AI features: prompt-injection exposure, tool permissions, key leaks via AI endpoints.
- Dependencies: known vulnerable packages.
Two ways to start
Add your site address and prove you control the domain (DNS record or HTTPS file) for an external check, or connect GitHub for a Deep scan of the code. The Deep scan sees far more and is the recommended path before launch.
What you get
- A short summary in plain language, then technical detail.
- Proof for each finding (request, response, file and line when code is available).
- A prepared fix, delivered as a GitHub pull request after your approval.
- A recheck that confirms the fix worked.