What actually breaks, and what to do about it.

Every guide here comes out of a repository we audited. No listicles, no roundups: one problem per page, how to check whether you have it, and how to close it.

Loïc Guillebeau

Founder, Grace · founder of Beyond the Brackets

Seven years running an engineering agency, ten AI-built applications audited in the last three months. Grace came out of both.

More about who is behind Grace →

16 August 2026

Your admin check asks the user whether they are an admin

Somewhere in your app there is a line that decides who is an administrator. In apps built with AI it is usually reading a field the user is allowed to write, which means the answer to "are you an admin" is whatever they last said it was. This takes one line in a browser console to exploit and about ten minutes to fix properly.

10 August 2026

Three ways an AI-built checkout lets people pay nothing

Your checkout works. You tested it with your own card, the money arrived, Stripe says succeeded. That test proves the happy path, and the happy path is not where payment code fails. It fails on the three paths nobody types by hand, and in all three the Stripe dashboard looks perfectly healthy afterwards, because what is missing from it is revenue that never existed.

9 August 2026

Your API key is in the browser, and rotating it is the first move

There are two kinds of key in a typical AI-built app. One is meant to be public and is fine where it is. The other bills you per call, and if it reached the browser then every visitor has a copy, minified but perfectly readable. The difference is worth two minutes, because the fix has an order and most people get that order wrong.

8 August 2026

Your AI-built app is slow because it waits in single file

It was fast when you built it. It is slow now, and you did not change anything. What changed is the data: with twelve rows and one test account, code that waits for one thing before starting the next feels instant. With two thousand rows and real users, the same code is the reason a page takes six seconds.

7 August 2026

Is your Lovable app's database readable by anyone?

Supabase creates every table with Row Level Security disabled, and the anon key in your frontend is handed to every visitor. If nothing turned RLS on, that key reads your tables. Since February 2026 Lovable checks for this before every publish, which closes the common case. This page is about the cases it leaves open, and how to find out in two minutes which one you are in.