I've been pentesting AI-built apps for free. What I'm finding is genuinely alarming.

# מהמקור

I've been doing free security assessments on apps built by non-developers using AI, and I need to talk about what I'm finding. The most common one: you can change a URL from /user/123 to /user/124 and read someone else's account. Change it to /users and get the whole table. Names, emails, addresses, order history - sat there in plain JSON, no login required. Just... there, for anyone who thinks to try. I've also found admin panels with no authentication at all, API keys committed straight into frontend code, and file upload endpoints that will happily run whatever you hand them on the server. None of these apps were built by careless people. They were built by smart, non-technical