# AI & Vibe-Coded App Security — geearr

> An AI-built app security audit checks software generated with AI coding tools for the mistakes those tools commonly make — exposed secrets, missing authorization, open databases — and reviews LLM agents for prompt injection and over-broad tool access. geearr delivers a fix-first list sized for a small team.

**Your AI wrote the code. Who checked it?**

AI coding tools ship features fast — and they also ship hard-coded keys, missing authorization checks and databases open to the internet. Meanwhile AI agents are being handed real tools and real data. geearr audits both: the code your AI wrote, and the agents you are about to trust with production.

## What gets tested

### AI-built applications

- Secrets in code, client bundles and repos
- Row-level security & authorization on every route
- Test vs. live data separation
- Personal data collection, storage & retention
- Backups, outages & handoff-readiness

### LLM & agent systems

- Direct & indirect prompt injection
- Tool / MCP server permission scoping
- Data exfiltration via tool calls & rendered output
- Model-output trust boundaries & sandboxing
- Tamper-evident logging of agent actions

### Production readiness

- Abuse, rate limiting & cost-exhaustion controls
- Hallucinated or typo-squatted dependencies
- Auth provider config: Supabase, Clerk, Auth0, Firebase
- Monitoring & alerting
- Scale & failure-mode review

## What you get

1. Eight-area risk report: secrets, environments, access, personal data, outages, handoffs, backups, growth
2. Fix-first list sized for a small team
3. Agent permission model & guardrail recommendations
4. Patches for critical issues
5. Optional 30-day Architecture Discovery

## Standards

OWASP Top 10 for LLM Applications · OWASP Agentic AI Threats · NIST AI RMF · MITRE ATLAS

## FAQ

### Is code generated by AI tools secure?

Not by default. AI coding assistants frequently produce working code with missing authorization checks, secrets embedded in front-end bundles, permissive database rules and outdated or non-existent dependencies. The code may function perfectly while exposing every customer record. An independent security review before launch is strongly recommended.

### What is prompt injection?

Prompt injection is an attack where untrusted text — in a web page, email, document or tool result — contains instructions that an LLM follows as if they came from the user or developer. In agents with tool access it can lead to data exfiltration or unauthorized actions. Defenses include least-privilege tools, human confirmation for sensitive actions, output filtering and isolating untrusted content.

## Related

- Guide: [Security checklist for AI-built (vibe-coded) apps](https://geearr.com/guides/ai-built-app-security-checklist)
- Glossary: [Secrets scanning](https://geearr.com/glossary#secrets-scanning)
- Glossary: [Least privilege](https://geearr.com/glossary#least-privilege)
- Glossary: [Row-level security (RLS)](https://geearr.com/glossary#row-level-security)
- Glossary: [Vibe coding](https://geearr.com/glossary#vibe-coding)
- Glossary: [Prompt injection](https://geearr.com/glossary#prompt-injection)
- Glossary: [MCP](https://geearr.com/glossary#mcp)

## Contact

- Email: george@georgerios.com
- Book a free 30-minute scoping call: https://cal.com/georgerios/30min
- LinkedIn: https://linkedin.georgerios.com
- X: https://x.com/riosgeorge

---
Canonical: https://geearr.com/services/ai-app-security · Updated: 2026-10-12 · Site index for LLMs: https://geearr.com/llms.txt