Question 1

Is my AI-coded app secure?

Accepted Answer

Often not. In a scan of 173 public AI-built apps, 79 had at least one critical vulnerability. The most common were committed secrets, broken access control (any logged-in user able to read other users' data), and unauthenticated backend functions. You can scan your own repo or live URL free at ShipWorthy.

Question 2

How do I check if my Supabase RLS is set up correctly?

Accepted Answer

Confirm every table's policy restricts rows to the owner (auth.uid() = user_id), not just that the user is authenticated. Test by logging in as a second user and trying to read the first user's rows. If you can, your RLS is broken.

Question 3

What does verify_jwt = false mean in a Supabase edge function, and is it safe?

Accepted Answer

It means the function runs without authentication — anyone with the URL can call it. If it fronts a paid API (OpenAI, ElevenLabs) or returns data, that is a serious exposure: strangers can run up your bill or read data. Set verify_jwt = true unless the endpoint is intentionally public.

Question 4

How do I find security bugs in AI-generated code?

Accepted Answer

Pattern matchers catch hardcoded keys and committed .env files, but the dangerous bugs are authorization-logic flaws that need understanding the code. ShipWorthy runs both: a free static scan plus a deep scan that finds broken auth and access-control issues.

Your AI-coded app is probably leaking secrets.