AI-Built Site Rescue: Review It, Fix It, Make It Rank, or Hand It Off
AI is a fine way to build software. Unreviewed software is the problem, whoever wrote it. If something looks wrong with your AI-built site, start with your keys and your database rules. Checked against vendor documentation on 9 November 2026.
Reviewed by Irina ShvayaLast reviewed
Where to start
- Keysreplace anything exposed
- Datacheck your database rules
- Reviewhave a person look before launch
- Searchtest, do not assume
Start here
You built it with AI. Where do you start?
Start with whatever could expose customer data or cost you money today. That usually means secret keys and database access rules.
AI is a fine way to build, and we use it ourselves. The problem is software going live without anyone reviewing it, whether a person or a model wrote it.
The tools say this too. Lovable says its scans cannot guarantee complete security and that you are responsible for meeting your app's security needs.
What changed
What changed recently
Supabase says it is deprecating the anon and service_role keys by the end of 2026. Apps generated with those older keys will need updating, so check yours now.
Rendering changed too. Lovable says apps created from May 13, 2026 use server-side rendering, or from June 22 on Enterprise plans. Older advice that these sites cannot be crawled may be out of date.
New tools appear quickly, and each handles keys and data differently. Check the current documentation for yours.
What to do first
Do these in order
Supabase warns that a table without row-level security is readable and writable by any role with a grant on it. It also notes that adding policies does not remove those grants. Vite warns that VITE_* variables should not contain API keys.
- If a secret key was exposed, replace it now
- Search your front-end code for keys that belong on a server
- Turn on row-level security and review each rule
- Check which database roles still have broad grants
- Plan your move off legacy Supabase keys
- Confirm you own the domain, database and hosting accounts
- Check that backups exist and that you can restore one
- Have a person review the code before it takes real data or payments
Who this is for
Who this guide is for
It is for founders, owners and small teams who built something with an AI tool and now rely on it. You do not need to be a developer.
If you think customer data was exposed, treat it as urgent. Notification rules vary, so speak to a lawyer as well as a developer.
We do not do penetration testing. If you need one, hire a qualified penetration tester. A review like ours reduces risk, but it cannot prove an app is safe.
Guides
Fix the urgent things
Practical guides, checked against vendor documentation on 9 November 2026.
I Exposed an API Key: What to Do in the Next Hour
A one-hour checklist for replacing a key and checking for misuse.
Read the guide →Row-Level Security in Plain English
What these database rules do, and the mistakes that leave data open.
Read the guide →Supabase's Legacy Key Deprecation: What AI-Built Apps Need to Do
How to check your app and the safe order to migrate.
Read the guide →How to Check If Your Website Has Been Hacked (Free Tools Inside)
The signs to look for if you suspect a break-in.
Read the guide →
Before and after launch
Keep it healthy
Written for teams using Claude Code, but most of the checks apply to any AI-built site.
Claude Code pre-deploy checklist for website changes
What to confirm before anything goes live.
Read the guide →Claude Code security checklist for website teams
Access, secrets and review habits for AI-assisted work.
Read the guide →Claude Code handover documentation: what you should receive at the end of a project
What to write down so someone else can take over.
Read the guide →JavaScript rendering and AI crawlers: what gets read
How to test what search engines and AI crawlers actually see.
Read the guide →How to Choose a Website Security Consultant: Credentials, Questions and Red Flags
What to ask before you hire someone to review your site.
Read the guide →
Guides
More guides
Plain-English explainers and checklists, each checked against its sources.
AI-Built App Security Review Checklist
A plain-English security checklist for AI-built apps, covering data rules, keys, logins, payments, dependencies and logs, before real users arrive.
Read the guide →Broken Access Control: Can One User See Another User's Data?
Broken access control lets a user reach data or actions they shouldn't. Learn the common forms in AI-built apps and how to check your own app safely.
Read the guide →Common Failures in AI-Built Apps: What to Check First
The failures worth checking first in an AI-built app, from open data and exposed keys to fake payment events, poor crawlability and no way to leave.
Read the guide →Stripe in an AI-Built App: What to Verify Before Taking Money
A plain-English checklist for Stripe in an AI-built app, covering API keys, webhook signatures, fulfillment, duplicate events and going live safely.
Read the guide →
Services
If you want help
These are existing eSEOspace services. We build with Claude Code ourselves and sell that service, so weigh our view with that in mind.
Website Security Consulting
A review of your setup, processes and vendors. It is not a penetration test.
See the service →Website Maintenance
Ongoing updates and fixes, including custom code and Next.js applications.
See the service →Claude Code Development
Websites and tools built with AI, with our engineers reviewing every change.
See the service →Technical SEO
Crawling, rendering and indexing problems. We do not promise rankings.
See the service →Custom Website Migration
Moving to a custom site when the current platform no longer fits.
See the service →
FAQ
Quick answers about AI-built sites
Is AI-built software less safe than software people write?
Do you do penetration testing?
Can you confirm my app is safe?
I pasted a key somewhere public. What now?
Can Google see my AI-built site?
Can I move my site off the builder?
Do I have to tell customers about a data leak?
Worried about something you shipped?
Tell us what you built and what looks wrong. We'll tell you what to do first, and whether we are the right people to help.
Talk to Our Team →
