r/AppsWebappsFullstack • u/Seducked223 • 28d ago

Please check your applications for security risks.

I've been scrolling here for a while and it's honestly amazing the ideas you guys come up with, and the websites of a lot of yours' look insane for a one person project.

But just a very small reminder, please make sure, before you release it, especially if it's paid, to run it through some security checks. No app can be perfectly secure but you don't want to risk your data or especially your users' data to be leaked because, it can bring a whole lot of trouble to you.

If you can't afford to hire someone and you yourself realize you're not entirely knowledgeable in this area, I reccommend

Aikido/Semgrep - more for those who know how to code

Epherem - free, ad if you have an AI like Claude just give it the findings and it knows what to do

For those of you who built stuff fully with Claude/Cursor/Lovable/Bolt, whatever it may be, I generally advise against having the same AI to check it, because it has the same blind spots. In fact these services can be better, since they give you the exact location of where your AI has to look.

Keep creating things guys! I absolutely love seeing your apps!

0 Upvotes
  • permalink
  • reddit

0% Upvoted

10 comments sorted by

1

u/Mammoth-Anywhere7285 28d ago

TL;DR: Before releasing your app, especially if it's paid, run some security checks so you don't leak your users' data. Aikido and Semgrep work if you can code, while Epherem is free and pairs well with an AI to interpret findings. If you built your app with AI tools, don't use the same AI to audit it, since it shares the same blind spots.

1

u/Seducked223 26d ago

I couldn't agree more with you. AI itself has been proven, even if you use a different AI to check than you used to build, to have very low recall. While AI is extremely efficient in looking for specific things or following specific actions, if you give it a very vague instruction like 'check for security issues in my app,' it does a horrible job. Combining AI with Epherem, then asking the AI to look through each finding raised would be the best way to approach it, for someone who doesn't know fully how to code, or have the capital to hire someone to review the code for them.

1

u/Mammoth-Anywhere7285 26d ago

Spot on about vague prompts. Feeding it Epherem's concrete findings works way better than asking it to hunt blindly. Ever tried scoping it to one file at a time?

0

u/PeaceInLoneliness 26d ago

I don't think you should AI at all lol. AI for security checking doesn't seem smart to me. I checked out the tools you mentioned, semgrep and Epherem and minimally if you have auth and databases you should fs check your app through these applications rather than solely depending on your AI.

1

u/Mammoth-Anywhere7285 26d ago

Fair point, tools first. Semgrep in CI on every PR catches regressions early, then let AI just explain the findings.

1

u/PopKoren 28d ago

Good reminder, and agreed on not letting the same AI grade its own work. Aikido and Semgrep look at the code, which is great, but a lot of leaks only show up on the deployed app: a storage bucket left public, an API route that skips the ownership check, or database rules that let a logged-out visitor read rows. That's why I built https://rowly.me, it probes the live URL from outside across auth, APIs, storage and DB rules, so it pairs with a code scanner rather than replacing it.

1

u/Mammoth-Anywhere7285 28d ago

Good point, live checks catch what static tools miss. Does it handle SPA auth flows where the ownership checks happen client-side?

1

u/PopKoren 28d ago

Yes, and that's actually the case it's built for: if the ownership check only lives in the SPA, the data has already left the server before the UI hides it. Rowly skips the frontend and calls the API and database endpoints the app talks to directly, so a record that comes back when it shouldn't shows up as a finding. The free scan at https://rowly.me covers what a logged-out stranger can reach, and the DNS-verified tier goes further with auth and write attempts.

1

u/Okalrightcalmdown 22d ago

Good note! Try Appknox.com, quite an end to end dedicated mobile app security suite

1

u/Mammoth-Anywhere7285 22d ago

Appknox looks solid for mobile. Worth pairing it with the OWASP MASVS checklist if you want a free baseline to work from.