Blog · ← All posts
Is Your AI-Generated App Safe to Ship?
Published: November 6, 2026 · 7 min read
The short answer
Your AI-generated app is safe to ship when two things are true: every mechanically checkable item on this checklist passes — secrets, injection shapes, authorization, token verification, LLM sinks, dependencies — and a human has judged the three things no scanner can: whether the business logic should do what it does, whether the architecture trusts the right parties, and whether the data you collect is data you may hold. The checklist below is built so each item names the Vibe-Code Audit detector that verifies it (62 detectors: 11 core, 51 advanced, plus the secret scanner). Run the mechanical half in minutes, free for the core set. Spend your human hours on the judgment half, where they are irreplaceable. November 2026.
The checklist — every item mapped to its detector
| # | Check before you ship | Verified by |
|---|---|---|
| 1 | No secrets in source, fixtures, or build artifacts — and any ever committed are rotated | Secret scan (32 patterns Pro / 15 Free) + build-artifact leak family |
| 2 | Every query parameterized; no string-built SQL or command construction | Core injection detectors |
| 3 | Every route checks authorization for this user on this record, consistently across layers | Core access-control detectors + header-vs-URL auth dispatch family |
| 4 | Token verification pins algorithm and key; forged and confused tokens fail | JWT key confusion family |
| 5 | No untrusted bytes reach a native deserializer or unsafe model loader | Deserialization gadgets + unsafe ML model loading families |
| 6 | User input never renders through a template engine unescaped, in any output (pages, email, PDF) | Advanced SSTI family |
| 7 | Model output is treated as untrusted: escaped on render, never executed, never stored as markup raw | Insecure LLM output handling + DOM clobbering families |
| 8 | User text that reaches a tool-calling prompt is screened; retrieved documents cannot issue instructions | LLM prompt-injection sinks + RAG poisoning + tool-call injection families |
| 9 | File writes canonicalize paths and land only in intended directories | Path-traversal file writes family |
| 10 | Every dependency exists, is the package you meant, and has no known critical vulnerability | SlopSquat Shield (live npm/PyPI verification) |
| 11 | Security headers set; session cookies flagged; errors don't leak internals | Header checks (free tier) + core misconfiguration detectors |
| 12 | Second-order paths reviewed: data stored "safely" isn't executed later in a trusting context | Second-order injection family |
The same twelve items, as a narrative of what they look like when they fail, are the 10 mistakes (twelve checks, ten mistake classes — two checks guard the same class from different sides).
The three checks no scanner can do
Business-logic judgment. A detector cannot know that your refund flow should require a second factor above $500, or that a "family plan" endpoint shouldn't let one account read another's invoices by design. If the rule lives in your head and not in any pattern, only a human review finds its absence. Trust architecture. Which services may call which, what a token from your own issuer should be able to do, whether the admin plane shares a fate with the public plane — scanners see code, not intentions. Data legitimacy. Whether you should be storing what the app collects at all — the privacy and retention question — is a legal and ethical judgment that precedes security: the safest data is the data you never took. Ship when the twelve pass and these three have been answered by a person who owns the consequences. That division of labour — machine for patterns, human for judgment — is the argument of the vibe code audit guide.
Frequently asked questions
How do I know if my AI-generated app is safe to ship?
Run the mechanical checklist — secrets, injection, authorization, token verification, LLM sinks, dependencies — where every item maps to a detector, and get a human judgment on business logic, trust architecture, and data legitimacy. Safe-to-ship means both halves done, not a green scanner alone.
What does the free audit cover from this checklist?
The 11 core detectors, the 15-pattern secret scan, security header checks, and URL scans — items 1 (basic), 2, 3 (core), and 11 in full or in part. The advanced families (JWT confusion, SSTI, LLM sinks, second-order injection) are the Pro path's 51 advanced detectors.
How long does the mechanical half take?
Minutes for a typical generated app: the scan is automated end to end and returns a shareable report with an exploitability-ranked Top-risks view on Pro. The human half takes as long as your judgment deserves — budget it like a review, because it is one.
My app has no AI features. Do the LLM items apply?
Items 8 and part of 7 are for apps that call models. If yours doesn't, they pass vacuously — but check anyway: generated apps acquire AI features quietly (a summarizer here, a chatbot there), and the sinks arrive with them.
What if the checklist finds something critical the day before launch?
Then it did its job the day before launch instead of the day after the incident. Secrets get rotated, sinks get closed, and the launch moves by the size of the fix — which is exactly the trade the checklist exists to make cheap.