Security checklist for AI-built websites

An app built with an AI coding agent needs the same security review as any other deployed app. “Vibe-coded” describes how the code was produced, not whether it is safe. Review both the source and the running deployment.

Before deployment

• Keep production secrets in server-side environment variables. Check the repository and generated browser bundles for accidentally embedded keys.
• Review authentication and authorization separately. Test that a second account cannot read or change the first account’s records.
• Validate inputs on the server. Do not rely on hidden buttons or client-side checks to enforce permissions.
• Review dependencies and database access rules. Confirm that administrative operations require the right role.

On the deployed website

• Confirm HTTPS, secure session cookies and sensible security headers.
• Check that deployment files, source-control metadata, backups and directory listings are not publicly exposed.
• Exercise sign-in, sign-out, failed requests and access from a second account. Test mobile screens and keyboard use as well.
• Verify signed payment and alert callbacks on the server. A successful browser redirect does not prove a payment occurred.

Where AgentDAST helps

AgentDAST checks an owned public HTTPS deployment through bounded, read-only requests. Supported evidence includes exposed environment credentials, private keys, public Git metadata, directory listings and a synthetic capture flag. Prove ownership, set a request/time budget, then inspect evidence or receive a signed alert.

It does not currently test authenticated application workflows, browser-based XSS, dependency vulnerabilities, or business logic. Combine it with source review, dependency scanning and tests for your access-control rules. A clean assessment is not a security certification.

Make checks repeatable

Use a separate staging deployment for experiments, keep ownership proof in place, and run a bounded check after releases. Treat a confirmed finding as a reason to investigate and fix the exposure. Decide explicitly how failed or incomplete assessments affect your deployment process.

Start with the website security API guide or connect your AI agent through MCP.

100 free assessments per month. No card required. Get a free API key.