Also promised, in theory: The keys aren’t in the bundle. The model only does its job. The rules got tightened after the demo. The defaults are safe.
The promises came with the build. Maybe the app is live, maybe the pilot stalled, maybe a vendor built it and handed you the keys. Either way you’ve had the thought: what else can this thing do, for someone who isn’t me? Good question. It deserves an answer before somebody else asks it.
Let’s talkYou’ve read the stories. The Tea app took off, and within days tens of thousands of user selfies and government IDs were spilling out of a storage bucket nobody had locked. CVE-2025-48757 documented the same gap as a genre: AI-built apps shipping with their databases readable by anyone who thought to ask. The pattern is public record and it keeps repeating, because the same tools keep building the same gaps.
These weren’t careless people, they were fast, and fast is a real advantage. But the tools that wrote the code care about one thing: does it work. Safe never came up.
The gap between working and safe is where the breach lives.
API keys pasted where the code needed them: the client bundle, the repo, a config file the whole internet can fetch.
The demo needed permissive rules to work, and the rules never got tightened. Any signed-in user, sometimes any visitor at all, can read rows that were never theirs.
If your product talks to a model, the model is an entrance. Prompt injection is a stranger talking your own AI into using its tools and its data on their behalf.
AI picked the packages, the versions, and the defaults, and no human reviewed the choice. Whatever is wrong with them is now wrong with your product.
None of this means you built wrong. You built fast, and nobody has looked yet.
AI is confident whether it’s right or wrong. The review exists to know the difference before someone hostile finds it for you.
For a decade at ShapeShift, this shop never touched customer key custody. That work was available and we did not take it: hold the keys and one mistake ends somebody else’s money with our name on it. The judgment was made against our own commercial interest, which is the only kind worth citing. The engagement is on the record, refusal included.
Behind that, the record it came from. We have shipped where being wrong costs money rather than embarrassment: an exchange from 2013, a lending platform holding collateral with Phil as fractional CTO through its launch, and fund rails moving real money for WallStreetBets. None of those were allowed to work only on the demo.
And we build with AI every day. That counts for more here than a certificate would: the tools that wrote your code are the tools that write ours, and we know where they cut corners because we watch them do it.
The scope stands whether we do the fixes or not. Take the ranked findings to your own engineers or to another firm; the document is built to survive that trip. If you want the people who found the gaps to close them, hardening and watch are priced on the same page, and you decide with the list in hand.
Nothing you send is used to train any model. The scope runs under NDA, signed before any sensitive code moves. When the work is done, your artifacts are deleted on request.
Innovation Theory has been at this since 2011, through several waves of new tech. We were shipping production systems before AI wrote a line of code.
Creative direction on Disney, Pixar, and Universal film campaigns.
25 years in the craft · 140+ engagements · in business since 2011
An AI security audit is a review of an AI-built application by someone reading it the way an attacker would: keys left in the client bundle or the repo, database rules never tightened after the demo, whether a stranger can talk the model into using its tools, and dependencies nobody reviewed. Every finding is ranked by the risk it carries. At Innovation Theory the review follows the free assessment, then the $5,000 AI Opportunity Audit, which sizes the job; review, hardening and watch are priced by that scope.
The free assessment is $0 and takes two days. The $5,000 AI Opportunity Audit comes next and finds out how big the security job is. The review, the fixes and ongoing watch are priced by that scope, so you decide with the scope in hand.
Code is not required for the free assessment; context is enough. If you want us to look at code, send it and we will. Never send credentials. Sensitive code can wait for the NDA that comes with the scope, the $5,000 AI Opportunity Audit. Nothing you send is used to train any model.
A security audit of an AI-built app checks what an attacker would: keys pasted into the client bundle or the repo, database rules the demo left open, what the model is allowed to touch and whether a stranger can talk it into using that, and the dependencies AI picked that nobody reviewed. Every finding is ranked by the risk it carries, with the reasoning written down.
Checking the security of AI-generated code means reading it the way an attacker would, because the risks are old ones arriving faster: keys left in the bundle, database rules never tightened, dependencies nobody reviewed, and a model a stranger can talk into using its tools. Every finding is ranked by the risk it carries, with the reasoning written down.
Revoke any key you think is out, even if it means a few minutes of downtime. Then email phil@innovationtheory.com with URGENT in the subject, and it goes to the front of the line.
No. We work inside your accounts, under your controls, with least-privilege access. The scope runs under an NDA signed before any sensitive code moves.
Yes. We were shipping production systems before AI wrote a line of code, and a key in a config file is the same gap whoever put it there. You get every change with the reasoning behind it, so the next build doesn’t repeat it.