Before real people trust it with their information
One audit of more than 200 AI-built applications found 91.5% had at least one flaw (SoftwareSeni, reporting a Q1 2026 audit by Kingbird Solutions). Treat that as a warning rather than a law: it is one commercial firm's sample, the method behind it was not published, and the article says so itself. But it matches what we find when we open these projects.
The five things we check first
- Can one customer see another's records? The most common serious fault, and the easiest to miss, because your own account looks fine.
- Are the keys in the code? Passwords and access keys written into files that ship to the browser are keys left in the door.
- Is anything checked on the server? If the only thing stopping a bad action is a disabled button, nothing is stopping it.
- Is sensitive information encrypted? Scrambled in transit and where it rests, so a copied file is not a readable file.
- Would you know if something happened? No records, no alarm, no way to tell afterwards what was touched.
If the answer to several of those is that you do not know, that is the normal starting point, and it is not a reason for shame. It is a reason to look before more people sign up.
What we do about it
We review what exists, tell you plainly what we found, and rebuild the parts that cannot be patched honestly. Where the data is sensitive, nothing is accessed until two agreements are signed: the business associate agreement, and the non-disclosure agreement.