“It’s secure.”
Show the evidence.

An AI security claim is a starting question

AI tools can help write and review code, but their assurance does not tell you which roles, endpoints, or data paths were independently tested. An AI-built website is not automatically vulnerable. The useful question is whether its specific controls hold when someone interacts with it outside the intended happy path.

Look beyond the visible interface

A button hidden from a user does not prove that its underlying action is protected. Depending on scope, a review can examine server-side authorization, ownership checks, database access rules, session handling, and whether browser-delivered code exposes credentials or privileged operations. Approved test accounts let us compare what different roles can actually read or change.

Check the connections between generated parts

A frontend, API, database, file storage service, and payment integration may each work separately while their combined permissions are inconsistent. Selected input and upload checks can help identify XSS, injection paths, and unsafe file handling. Configuration review and source review are distinct activities and are included only when explicitly agreed. Third-party services need their own authorization boundaries.

Turn a finding into a fixable issue

The deliverable describes the observed behavior, the minimum controlled evidence needed to reproduce it, relevant impact, and remediation direction. No private customer data or credentials belong in a public demonstration. A founder-reported experience can motivate testing, but it is not a measured failure rate for all AI-built websites.

A few practical answers.