AI builders are good at making an app work. They are less good at telling you what is still left open. These are ten plain questions to ask before real users or payments arrive. You don't need to read code to ask them: for each one there is a way to check it yourself, or a question to put to your AI builder.
General good practice. Not a standard, and not a guarantee. Each item also says how much Verilay itself covers it, and where the answer is that it doesn't.
Why it matters. Hiding a button doesn’t protect a page. Anyone can type the address of an admin page or call the data directly, so the server itself has to say no.
How to check. Open a private (incognito) window, so you’re not logged in, and paste the address of a page that should need a login. You should be sent to a login page. Then ask your AI builder: "Show me where the server checks that the user is logged in for the admin pages."
Verilay: fixed check for some apps, plus AI review The AI review reads your login code. For Supabase apps, a fixed rule also looks for backend functions that skip the login check.
Why it matters. This is the most common serious mistake in apps with logins: the page works, but any logged-in user can see everyone’s records.
How to check. Make two test accounts with two email addresses you own, A and B. As A, create something private. Log in as B in a different browser and try to find A’s item, including by pasting A’s page address.
Verilay: fixed check for some apps, plus AI review For Supabase apps, fixed rules look for missing access rules. The AI review looks at other apps. The two-account test is one only you can run.
Why it matters. A table with no access rule can be read, or changed, by anyone who has your app’s public key, and that key is meant to be public.
How to check. Ask your AI builder to list every table that holds user data and the access rule on each. If you use Supabase, open each table in the dashboard and look for Row Level Security switched on.
Verilay: fixed check for some apps, plus AI review A fixed rule checks Supabase apps. For other databases the AI review looks, and can miss things.
Why it matters. Bots scan public code for keys within minutes. Deleting a file doesn’t remove a key from the project’s history, so a leaked key has to be replaced, not just hidden.
How to check. Open your live app, view the page source (Ctrl+U) and search for words like secret, key and token. Search your code the same way. If a real key appears anywhere, make a new key in the service’s own dashboard and switch to it.
Verilay: fixed check A fixed check reads every current file for keys and passwords. It does not read a project’s history.
Why it matters. If an app puts what you type straight into a database query or onto a page, a clever input can read data or run code. These are called injection and cross-site scripting.
How to check. In a search box or a form, type a single apostrophe and submit. Then type <b>test</b> into a box whose content is shown back later. You should see the characters exactly as typed, and a normal error at worst.
Verilay: AI review The AI review looks for it in the code. You can also run the two tests above. A clean result doesn’t prove an app is safe.
Why it matters. An upload box that accepts anything can be used to store harmful files or to fill up your storage and your bill.
How to check. Try uploading a harmless file of the wrong kind, such as a text file where only pictures are expected. The app should refuse it with a clear message.
Verilay: AI review The AI review looks at upload code. Whether an uploaded file could be dangerous needs an experienced person.
Why it matters. CORS decides which other websites may talk to your app’s server from a visitor’s browser. If it allows every site, any website can ask your server for data on a visitor’s behalf.
How to check. Ask your AI builder: "What origins does our CORS setting allow, and is it set to everything?" For anything that returns private data, the answer should be your own site, not a star.
Verilay: AI review The AI review may notice it. It isn’t a fixed rule, so don’t rely on a scan for this one.
Why it matters. Without limits, someone can try thousands of passwords, or call an AI feature in a loop and run up your bill.
How to check. On a test account, enter a wrong password about ten times in a row. You should be slowed down or blocked. Ask your AI builder what limits exist on anything that costs you money.
Verilay: AI review The AI review looks for it. The wrong-password test is one you run yourself.
Why it matters. A webhook is a message from another service, such as "this payment succeeded". If your app believes any message without checking the sender, someone can fake a payment.
How to check. Ask your AI builder: "Does our payment webhook verify the signature from the payment provider before it trusts the message?"
Verilay: AI review The AI review looks at these endpoints. A person should confirm anything that touches money.
Why it matters. Apps are built from other people’s packages, and old versions can have known holes. A saved lock file lists exactly which versions you use, so they can be checked.
How to check. On GitHub, open your repository, then Security, then Dependabot alerts. Update packages one at a time and test after each.
Verilay: fixed check A fixed check compares your packages with OSV.dev, a public list of known vulnerabilities. Updating them is up to you.
Why it matters. If an update breaks something, or data is deleted by mistake, you want a copy and a way to go back to the last version that worked.
How to check. A GitHub repository keeps every earlier version of your code. For your data, switch on your database’s backups and find out how to restore one.
Verilay: not checked This lives outside the code, so a scan can’t see it.
Where Verilay fits. Verilay covers parts of this list: fixed checks for keys in your code, known-vulnerable packages and, for Supabase apps, access rules, plus an AI review of the code it reads. The AI review can vary and can miss things, and the free scan reads the most important files rather than all of them. Everything else you test yourself, or ask a person to look at.
If you’re not sure yet that your app will earn anything, the free version is a good place to start: fix what it finds with your AI builder first, and think about a deeper review once you have users or payments to protect.
For anything serious, such as real money or sensitive data, have an experienced person look as well.
Run a free check No account needed. Public GitHub link or a ZIP. What we keepWritten by Moses, a non-developer who builds with AI tools. If something here is unclear or wrong, email [email protected].