Could my app be exposing personal data?
Last updated
Symptom
There's no visible error. The app works, but anyone with the link can see or change data that isn't theirs, or a secret key shows up in the code.
Cause
To show you a working app quickly, the AI sometimes leaves the database open, with no rules about who can read what. Everything looks normal on the screen, because the app shows what it should. The problem is what someone with bad intentions can reach from the outside.
Another common slip is putting a service’s access key, such as an API key, directly in the code that goes to the browser, where anyone can read it.
How can you check without knowing how to code?
- Open the published link in a private (incognito) window, without logging in, and see what appears.
- Create two test accounts and check whether one can see the other’s data.
- Use made-up data until you’re sure everything is protected.
Prompt to paste
Copy the text below, replace what’s in brackets and send it in the chat of the tool you’re using.
This app will store personal data about other people: [which data, for example "customers' names, phone numbers and addresses"].
Review it and answer me in plain English:
1. Can someone who isn't logged in see or change this data?
2. Can a logged-in person see another person's data?
3. Is there any password, access key or secret information visible in the app's code?
List the problems from most serious to least serious, and only fix them after I confirm.How not to burn credits
- Ask for the review and the list of problems first, and only then for the fixes, as the prompt does. That way you don't pay for changes you didn't want.
- Do the free checks yourself before asking the AI anything. Open the published link in a private (incognito) window without logging in, and create two test accounts to see whether one can see the other's data.
- Use made-up data while you build. You can test as much as you like without real data at risk.
How Lovable counts credits, and what the free plan includes: Lovable credits explained.
Frequently asked questions
Does a small app need to worry about privacy laws?
Privacy laws such as the GDPR in Europe can apply to small businesses too, not just large companies. If your app stores customer data, learn what the rules require where you and your customers live, or ask a professional.
Is the AI's review enough?
No. It helps find obvious problems, but it doesn't replace a review by someone who understands security. For sensitive data, such as health information or documents, or for payments, get professional help before you publish.