How to secure a vibe-coded app before you share it

Last updated 26 October 2026. Written by TeamOnly. We host internal apps built with AI, and each item says honestly where we help and where we don't.

Quick answer: Before coworkers use an app you built with AI, check four things first: nobody gets past a company login, only your company's accounts get in, no keys are in the code that runs in the browser, and the database can't be read without going through the app. Then check who can do what inside it, and who owns it when you leave.

Most leaks from AI-built apps are not clever attacks. They are open doors: a public link, a database with its rules turned off, a key in the page. This checklist is for the person who built the app and the IT person reviewing it. Each item says what goes wrong, how to check it in plain words, and what TeamOnly handles and what is still on you.

What goes wrong with AI-built apps

AI tools are good at making an app work. They are less careful about who else it works for. Three findings from the last two years show the pattern.

• 380,000 publicly reachable assets found on Lovable, Base44, Netlify and Replit by the security company Red Access in May 2026. About 5,000 held sensitive company data, and many were indexed by Google.
• 170 of 1,645 Lovable apps checked in March 2025 let anyone read or change data in their Supabase database without signing in, because the database access rules were missing or wrong (CVE-2025-48757).
• 205,474 made-up package names suggested by 16 AI models across 576,000 code samples, in a 2025 study. Attackers can publish packages under those names and wait for someone to install them.

None of these needed a clever attacker. The doors were open. That is good news: open doors are easy to check for, and you don't need to read code to do it.

Checked 26 October 2026. Sources: Security Boulevard on Red Access's findings (May 2026), Matt Palmer, statement on CVE-2025-48757 (2025), Spracklen et al., "We Have a Package for You!" (USENIX Security 2025).

Read the full guide

It goes on to cover: 11 checks before you share the link; The one-minute check; Reviewing an app someone built.

Continue on teamonly.dev: How to secure a vibe-coded app before you share it