The AI said the code is secure. Why that isn’t enough

What AI sees, and what it doesn’t

A language model assesses the code it is given as context. What often stays outside its view:

• database configuration and access rules set up outside the repository,
• cloud service settings, keys and permissions,
• how the running application behaves: what the server actually returns when an unexpected request arrives.

The most common blind spot: permissions only in the app

Modern cloud databases (such as Supabase or Firebase) let the browser talk to the database directly, using a public key. Security then rests on rules in the database itself.

If the application checks who may do what but the database doesn’t, it is enough to bypass the application. An AI review of application code can easily miss this, because the code on its own looks correct.

Why AI sounds more certain than it should

Models are trained to be helpful and clear. “Everything is fine” sounds professional even when the model didn’t have everything it needed. Confidence in tone is not confidence in content.

How we do it

• Built and reviewed with AI: We write and review code using AI technologies. A language model automatically reviews every change in the CI/CD pipeline.
• Rules in the database, not just the app: The client has no write access where it doesn’t need it.
• Automated security tests against a real database: They verify that neither an anonymous nor a regular user can reach other people’s data.
• A critical finding blocks deployment: Until it is fixed, the change does not go to production.
• Review by a security expert: Before deployment, our security expert goes through the application looking for every possible issue: in the code, the database, the configuration, and in what AI can’t see.