AI-built product security worries usually land on the wrong layer
When an owner worries about the security of an AI-built product, the worry usually lands on the wrong layer.
It lands on the managed backend, the Firebase or the Supabase. That is the first thing every commodity scanner flags, which is exactly why it tends to be the part that already got patched.
The exposure that lasts is the custom API the generator wrote around it. Routes nobody has read, doing far less checking than the screens in front of them imply, because whoever generated them had no reason to assume anyone would call them directly.
Your screens are optional. The routes behind them can be called by anyone who looks.
If your product was largely generated and you now have paying customers inside it, the question is no longer whether it works. It is what it does when someone talks to it without the interface in the way. A developer with no stake in the answer can tell you in an afternoon, and it is worth asking while the customer count is still small.
https://lnkd.in/eTbyxqGD