VANDAMInternal Apps Sweep
The apps your staff builtprobably include one that leaks.
A register of every internal app and agent your staff built with AI, each tested for the leaks these tools are known for, fixed or switched off, and a one-page rule so people can keep building without exposing the company.
$8,000 two weeks, up to 25 apps
AI app builders ship fast.
Many of their apps ship open.
- 170
- of 1,645 Lovable apps scanned had databases readable by anyone, exposing names, payment details and API keys. Matt Palmer, CVE-2025-48757, May 2025.
- 400+
- exposed secrets and 175 cases of exposed personal data in more than 5,600 public apps built with AI app builders. Escape, October 2025.
- 45%
- of AI-generated code samples failed security tests across more than 100 models.
Veracode GenAI Code Security Report, July 2025.
Building an app now takes an afternoon.
Securing it still takes knowledge.
A sales manager builds a quote calculator in Lovable. An HR assistant asks 
Claude for an onboarding tracker and puts it online. Someone in finance connects a spreadsheet to an agent. Each of these is useful, and none went past IT. The tools write working code fast, and they leave the security settings to whoever is typing.
The same holes come back again and again. In March 2025 the developer Matt Palmer scanned 1,645 apps built with Lovable and found 170 whose databases let anyone read data they should not see, including names, phone numbers, payment details and API keys. In October 2025 Escape scanned more than 5,600 public apps built with AI app builders and found over 2,000 vulnerabilities, more than 400 exposed secrets and 175 cases of exposed personal data, from medical records to bank account numbers.
The cause is usually one setting. Many of these apps sit on Supabase, whose own documentation warns that “a table in an exposed schema without RLS is readable and writable by any role with a grant on it.” 
Firebase warns that with open rules “anyone who guesses your project ID can steal, modify, or delete the data.” The key that unlocks the database often ships in the page itself, readable by anyone who opens the browser’s developer tools.
In February 2026, Wiz found that Moltbook, a social network for AI agents built largely with AI, had exactly this setup: a key in the page’s JavaScript gave anyone read and write access to the whole database, including 1.5 million API tokens and 35,000 email addresses. Your internal tools are smaller, and they hold your customers, your staff files and your prices.
We find these apps first, because nobody has a list. Then we test each one the way an outsider would, fix what we can in the same two weeks, move the useful ones into company accounts and switch off the ones nobody needs. The sweep ends with a rule people can follow, so building stays allowed.
What you keep after the two weeks.
The register opens with every AI-built tool we found, who made it, what data it touches and our verdict: keep, fix, move or retire. Underneath sit the findings, ordered by what an outsider could reach, each with the request that proves it and the fix that closed it.
The builder’s rule and the starter project stay with your IT team. The next person who builds a tool starts from a setup that already has sign-in, row-level security and keys in the right place.
- Onboarding tracker · HRCritical, fixed
- Quote calculator · SalesHigh, fixed
- Expense agent · FinanceHigh, drafts only
- Supplier portal · OperationsMedium, re-test Friday
- Event sign-up · MarketingRetired
What every sweep covers.
Up to 25 apps and agents in two weeks. Larger estates are priced on the count.
App discovery
Workspaces, databases, OAuth grants, automations and the forms each team fills in.
Owner per app
Who built it, who uses it and who answers for it now.
Data map
Which customer, staff and finance data each app reads, stores and sends.
Open database check
Row-level security and storage rules tested without signing in.
Key check
API keys and service keys found in pages, repositories and chat logs, then rotated.
Access check
Sign-in on every page and route, and one user reaching another’s records.
Fixes and retirements
Holes closed, keepers moved to company accounts, the rest switched off.
Builder’s rule
One page and a starter project for the next app.
How the two weeks run.
Find every app and agent
We ask, and we look. A short form to every team, then the places these apps leave traces: Lovable, Bolt, Replit and Vercel workspaces, Supabase and Firebase projects, Google and
Microsoft OAuth grants, browser extensions, Zapier and Make accounts and expense lines. Each app gets an owner, a purpose and a list of the data it touches.Found in week one - Quote calculator · LovableSales · customer prices
- Onboarding tracker · ReplitHR · staff files
- Expense agent · Zapier and
ChatGPTFinance · card data - Stock dashboard · CursorOperations · no personal data
- Event sign-up · BoltMarketing · unused since May
Test each one for the common leaks
For every app in scope we check whether its database can be read without signing in, whether keys sit in the browser, whether every page and API route checks who is asking, whether one user can see another’s records, and where its data is sent. Each finding is proven with a request anyone on your team can repeat.
Onboarding tracker, page source const supabase = createClient(url,- -
'eyJhbGciOi…service_role…') - +
'eyJhbGciOi…anon…') // table staff_files- +
alter table staff_files enable row level security;
Example. The service key in the page could read every staff file.
Fix, move or retire
Row-level security switched on, keys moved to the server and rotated, sign-in added through your company accounts. Apps worth keeping move into company-owned accounts with a named owner. Apps nobody uses are switched off after a warning to their maker. Every fix is tested again.
Verdicts - Quote calculatorfixed, moved to company account
- Onboarding trackerfixed, keys rotated
- Expense agentdrafts only, owner named
- Event sign-upretired after notice
Leave a rule people can follow
One page: which tools staff may build with, which data needs IT first, how to sign in, where keys go and who to ask. With a starter project that has sign-in and security settings already in place, so the safe way is also the quick way.
Builder’s rule, page one - Build with
- Lovable, Cursor or Claude, in the company workspace
- Sign in
- Company Google or Microsoft account only
- Keys
- In the server settings, never in the page
- Ask IT first
- Customer, staff or payment data
Swept once.
Swept again every month.
People keep building, and that is the point. After the sweep we can come back every month: find what is new, test it, and keep the register current, so a new app never sits open for long.
New apps found
Workspaces, databases and OAuth grants checked again for anything built since last month.
New apps tested
The same leak checks on every new app, with fixes applied.
Register kept current
Owners, data and verdicts updated, retired apps confirmed off.
Builders’ hour
A monthly session where staff bring what they are building and leave with it set up safely.
What you
receive.
App register
Every AI-built tool in the company, with an owner, its data and a verdict.
Findings, fixed
Each leak with the proof, the fix applied and a re-test.
Builder’s rule
One page and a starter setup so the next app is built safely from day one.
Where the sweep leads.
Each next step has its own service.
Adversarial App Audit
For the one app that matters most: a deep review of its code, with the fixes attached.
$9,600
Agent Attack Audit
For the agents the sweep found: planted instructions, wide scopes and exposed keys, tested and fixed.
$8,000
Team Harness
Gives staff a safe, supported place to build, with the rule from the sweep built in.
$12,800
AI Act Deployer File
Turns the app register into the AI Act file: a risk class and the duties for every system.
$8,000
Before you ask.
Will you shut down tools people depend on?
Not without warning. Each app’s maker and its users hear our verdict first. An app that leaks but is useful gets fixed or moved, not switched off. We only retire apps nobody uses or that cannot be made safe, and your IT lead decides.
How do you find apps nobody told IT about?
We combine a short form to every team with what the systems already record: OAuth grants in Google or Microsoft, projects in the AI builders’ workspaces, Supabase and Firebase accounts paid with company cards, and automation accounts. Most apps leave several of these traces.
Is this a ban on building with AI?
No. The sweep ends with a rule and a starter project that make building safely the easy way. Companies that ban it tend to push it into personal accounts, where nobody can see or fix it.
What if we have more than 25 apps?
We price larger estates on the count after the first discovery day, and agree it in writing before testing starts.
How is this different from the Adversarial App Audit?
The Adversarial App Audit goes deep on one important application. The sweep goes wide: every small tool in the company, tested for the leaks AI-built apps are known for.