The fastest way to get hacked is to ship an AI-built SaaS without checking a few security basics. The mistakes are always the same handful: secrets exposed to the browser, a database anyone can read, webhooks nobody verifies, privileged actions running client-side, and admin routes anyone can reach. Below is the short checklist that catches the ones that actually lose data — and how a codebase built for this handles them so your AI agent can't quietly skip them.
The SaaS security checklist
- Keep secrets server-side. API keys, the Stripe secret, database admin credentials, and storage keys must never reach the browser. Only clearly public values should be bundled to the client.
- Lock down the database.Use access rules — row-level security (RLS) in Postgres, or security rules in Firestore — so a user can only read and write their own data. A query that looks right in a demo can still expose everyone's records.
- Verify webhook signatures.Payment webhooks decide who gets access. If you don't verify the signature, anyone can POST a fake "payment succeeded" and unlock your product for free.
- Do privileged work server-side. Charges, entitlement grants, file signing, and admin checks belong on the server, behind authenticated routes — never in client code that users can inspect and call directly.
- Gate admin routes in depth. An email allowlist, a server-side check on the page, an independent check on every admin API, and database rules — not just a hidden link.
- Scope file storage per user.Presign uploads server-side and scope object keys to the authenticated user, so one user can't read another's files by guessing a URL.
Why AI makes this worse — and how to fix it
Under pressure to produce something that runs, AI agents reproduce insecure patterns and leave these exact holes — which is a big reason AI-generated code carries more vulnerabilities. The fix is to not leave security to the prompt of the moment. Weekendstack ships every item above already done — server-only secrets, Firestore security rules, signature-verified Stripe webhooks, role-gated admin routes, per-user storage keys — and the CLAUDE.md and prompts tell the agent to flag when a change would break one, instead of silently shipping it.
Want the security-sensitive parts done and guarded? See Weekendstack, or read why unguided vibe coding turns into spaghetti.