The single most common way AI-built apps get wiped is a Firebase/Firestore rule left on “allow read, write: if true.” It means anyone on the internet can read or delete your whole database. Check your rules in seconds.
Runs in your browser · your code never uploads · results in seconds
Hardcoded API keys, tokens, and passwords in the code
Databases left wide open (Firebase / Supabase rules)
A .env file that isn’t protected from upload
Secrets shipped to the browser, SQL injection, and open CORS