5 security holes I find on almost every AI-built site

Sites built fast with AI have one thing in common: the same mistakes keep coming back. Not because AI is stupid, but because it optimises for "it works", not for "it's safe". After a year of audits, a handful of findings recur often enough to rank them.

1. An exposed .env file

The most common and the most dangerous. The config file holding your database credentials, API keys and secrets, reachable straight from the internet:

https://your-site.com/.env → 200 OK

Anyone can download it and walk away with the keys to the kingdom. The fix is trivial — never deploy .env into the webroot — but AI generators leave it there routinely. (Why an exposed .env is a catastrophe, and how to close it.)

2. Keys sitting in the page source

A Stripe key, an OpenAI token, a Supabase service key — hardcoded into JavaScript that every visitor downloads. "It's only the frontend" is not an excuse; a secret in the browser is a secret in the wild. Scrapers find bundled keys within hours of launch.

3. Missing security headers

Without Content-Security-Policy the site is open to injected third-party scripts (XSS). Without Strict-Transport-Security the connection can be downgraded to plaintext. Headers cost nothing, and AI almost never sets them. Here's what each one does, in plain language.

4. An open .git directory

Deploy the whole working directory and the commit history ships with it — publicly downloadable, and often still holding the deleted keys someone believed were gone.

5. A database without Row Level Security

Supabase and backends like it are excellent, right up until you forget to switch RLS on. Then anyone can read other people's data straight through the public API. How to switch RLS on without breaking your app.

---

None of these needs a hacker. Curiosity and a browser will do. The good news: all five can be found in under a minute — which is exactly why Reconvio exists.

These five are the greatest hits. For the whole list — database rules, authentication, DNS, dependencies and the compliance gaps AI skips too — work through the complete security checklist for AI-built sites.