“Es una empresa con un buen equipo, te resuelven cualquier duda que puedas tener y plantean buenas soluciones a los problemas que te pueda surgir. Muy recomendable.”
Cliente verificado
AI GOVERNANCE
Security in AI-built applications: what the demo never shows you
An agent can write a working application in an afternoon. Working does not mean secure: who gets in, what each role sees, which dependencies it drags along, where the keys are and what happens to data when someone requests it through the wrong URL.
Why a generated app is different
An application written by an agent looks a lot like one written by a person in a hurry: it solves the happy path and leaves the edges for later. The difference is speed. What used to take three weeks to reach production now arrives in a day, and the holes arrive earlier too.
The typical failures are not exotic. A screen showing more data than the role should see, a query concatenating text instead of using parameters, an uploaded file without type validation, an API key written into the frontend, or a dependency added by the agent that brings a known vulnerability.
The underlying problem is that the agent optimises for the application to work, not for it to resist someone trying to break it. And in a company, the application that started as an internal tool ends up holding customer data and real access.
Reviewing does not mean distrusting AI: it means applying to its output the same criteria applied to any code going to production, with the advantage that here almost all of it can be automated.
THE CHALLENGE
Applications that work and are not protected
AI-generated code usually solves the happy path; what fails is what nobody asked for: permissions, validation and data handling.
Decorative permissions
The application checks the role in the interface, but the API answers anyone who knows the address.
Unvalidated input
Forms accepting anything and queries built from user text: the shortest route to an injection.
Secrets in plain sight
Keys written into the code or the repository, visible to anyone with project access and hard to rotate afterwards.
APPROACH
Review like an attacker, fix like an engineer
A scanner is not enough: we test the real flows of the application with the techniques an attacker uses and fix with a least-privilege mindset.
Surface map
We inventory routes, forms, file uploads and internal calls: everything that receives data from outside.
Controlled attack tests
We verify injection, broken access control, XSS and file upload, with evidence for each attempt and its result.
Fix in the code
Server-side validation, permissions enforced in the API and secrets moved to secure configuration, not patches in the interface.
Verification afterwards
We repeat the tests after each fix: a finding closes when the attack fails, not when the fix has been written.
DELIVERABLES
Evidence that the attack no longer works
A technical report reproducing each finding and proving that the fix closes the vector.
Security report
Findings ranked by severity, with the specific request that triggers them and their real business impact.
Corrected code
Changes applied in the repository with review, tests and controlled deployment to test before production.
Cleaned dependencies
Libraries with known vulnerabilities updated or replaced, with the fixed version verified.
Defensive rules
Header configuration, upload limits and error logging so the application does not fall back into the same hole.
TRUST
Applied security, not theory
We review and harden enterprise applications since 2008, with offices in Barcelona and Madrid and remote collaboration across Spain, Europe, LATAM and the US. OWASP-aligned practices and ENS awareness, with the code always in your hands.
- Every application born in Citizen inherits authentication, roles and server-side permission checks.
- Dependency and control review before every push to production.
- Secrets in a per-project vault, never in code or chat, with separate data per environment.
- Documented evidence for audit: what was reviewed, with what result and who approved it.
FAQ
Questions about security of AI-built applications
Have a project in mind?
Tell us what you need around security of AI-built applications. We will help you turn it into a clear, viable delivery plan.
