Does the app my agent built leak my data?

You used an agent to build the sign up form for your club, with the member list behind it. On October 20, CERT-FR, the French government's computer security alert center, published its review of nearly 200 data breaches from web applications, tracked in 2025: often, the attacker only needed simple actions, without exploiting any technical flaw. The door was open. For your form, that could be an address ending in a member number: change the number, and another record shows up. The way out comes down to three checks, which your agent does with you.

First step, know what is exposed. Ask the agent for a list of everything the app shows on the internet (pages, API addresses, files), and check what a logged out visitor can read there. For the club, the member list must not appear anywhere without logging in.

Second step, everyone sees only their own record. Check that a logged in member cannot read another member's record, and that no key or secret sits in the code sent to the browser: anyone can display that code. If your database is plugged straight into the page, every table must have its row level access rule turned on; a table without a rule is a public table.

Third step, an automated check, on your own app only. codex-security, OpenAI's checking tool (11,140 stars, Apache-2.0, already mentioned in issue 007), reviews your project. More aggressive, strix (Apache-2.0) attacks your app the way an intruder would, with an AI; it shows more than 70,000 stars, a counter to take with caution. Run them on your own machine or on a test copy, never on someone else's site, and run them again after every change that touches the data.

What this does not fix: a check tells you what it found that day, not what your agent's next change will add.

CERT-FR's review its ten ways to reduce the risks.