Unreviewed AI-Built App
An assistant built it in a weekend. Nobody reviewed it.
What Is Unreviewed AI-Built App?
An app an AI assistant built end to end is still software your company ships, and it needs the same review as any other. Here a product manager built a refunds dashboard over a weekend and put it on a public preview link, with no sign-in and a live payments key in its code. You'll review the code, take the link down, bring it back behind company sign-in, rotate the key in the right order, and set a rule for the next AI-built tool.
What You'll Learn in Unreviewed AI-Built App
- Explain why software an assistant built end to end needs the same review, authentication and secrets handling as any other company code
- Use a provenance bar to see how much of a repository was written by an assistant and how much anyone has reviewed
- Recognise that a preview link is public, because new certificates are logged where anyone can watch for them
- Contain an exposed internal tool by taking it down, then restoring it only behind company single sign-on
- Rotate a key that sat in exposed code in the right order, revoke first, and move its replacement out of the source
Unreviewed AI-Built App — Training Steps
-
A quick look before Monday
Lena, Mirefell's product manager, has filed an issue for you in Jotvane, the team tracker, about something she built over the weekend.
-
Open the repository
Lena's project opens in the Code app: six small files for a server, its routes, its config, a database helper, the package manifest and a README. Every line in the gutter is violet and dashed. Claude wrote it, and no person has reviewed it.
-
Nobody has read it
The provenance bar counts the whole repository, not only the file in front of you.
-
No sign-in in front
Start with the server, where every request comes in. Read server.ts , then mark Claude's lines reviewed from the gutter: the violet marker turns solid once a person has read them.
-
A live key in the code
The routes approve refunds through Cobwenpay, Mirefell's payments provider, so the server needs a key. Find where it comes from: read config.ts and mark its lines reviewed.
-
The public dashboard
Now look at what this code serves. Open the preview link from Lena's issue in the browser, beside the code.
-
Anyone with the link
The footer says where it is hosted. Open the project on Thistlepush, the one-click preview host Lena deployed to.
-
A preview nobody locked
Bob watches public certificate logs for new preview hostnames. The certificate for refunds-4f9c2a.thistlepush.app was issued the moment Lena deployed on Friday, so the name is already in the logs. He opens it to see what it serves.
-
An outside visit
You were still writing up your notes for Lena when Tomasz, Mirefell's security lead, filed an issue.
-
Why it shipped like this
Security Framework Coverage
OWASP Top 10
- A07:2025 Authentication Failures
CWE
- CWE-306 Missing Authentication for Critical Function
- CWE-798 Use of Hard-coded Credentials
MITRE ATT&CK
- T1552.001 Unsecured Credentials: Credentials In Files
CIS Controls
- CIS 16 Application Software Security
- CIS 6 Access Control Management
NIST CSF
- PR.AT-02 Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- PR.PS Platform Security
- PR.AA Identity Management, Authentication, and Access Control