The words your developer uses, explained

A rule on a table in your database that says who is allowed to read or change each row. New tables start with no such rule, so nothing is protected until someone adds one.

What it costs you With no rule, anyone who finds the address of the table can read every row in it, straight from a browser. This is the most common serious leak in AI-built apps.

We check for this, free →

The shape of your database: which tables exist, what columns each one has, and how they relate. Not the data itself, the arrangement of it.

What it costs you Nothing on its own, and reading it tells us how your app is built without us ever reading a customer’s details. It is the safest thing to hand over and often the most useful.

A recorded change to the shape of your database, kept as a file so the same change can be made again on another copy. It is how a database gets from yesterday’s shape to today’s.

What it costs you If one is written but never applied where it matters, your app expects a table that is not there and the page using it fails. The code looks right and the app is broken.

A copy of your data kept as it was at some moment, so it can be put back after a mistake.

What it costs you Most apps built quickly have none, and nobody discovers that until the day it matters. One bad instruction wipes a table for good, and the only question afterwards is how old your last copy is.

Where your app keeps files rather than rows: photographs, uploads, invoices, anything that is not text in a table.

What it costs you A bucket set to public hands out every file in it to anybody with the address, and people upload things to an app that they would never publish. Passport photographs and signed contracts turn up this way.

We check for this, free →

A code your app hands to every visitor so their browser can talk to your database. It is meant to be public and is safe on its own.

What it costs you Nothing, by itself. It only becomes dangerous when a table has no rule about who may read it, because then the public key is all a stranger needs.

We check for this, free →

The master key to your database. It ignores every rule you set about who can read what, so it is meant to live only on your server, never in a visitor’s browser.

What it costs you If this ends up in the code your site sends to browsers, anyone who looks can read, change or delete everything you hold. It is one of the worst things to expose.

We check for this, free →

A password your app uses to talk to another service, like the one that takes payments or sends email. Each one is meant to be kept private on your server.

What it costs you If one is left in the code a visitor can see, someone can copy it and spend your money or send email as you. The bill is often how you find out.

We check for this, free →

A signed pass your app gives a visitor after they log in, which their browser shows on each request to prove who they are.

What it costs you If one is stored carelessly or never expires, someone who gets hold of it can act as that customer until it is changed.

A setting kept outside your code, usually for secrets like keys and passwords, so they are not written into the app itself.

What it costs you If the file holding these is published with your app by mistake, every secret in it is exposed at once. We check for this.

We check for this, free →

Turning a password into a scrambled string that cannot be turned back, so what you store is proof somebody knew the password rather than the password itself.

What it costs you If passwords are stored as plain text instead, a single leak hands over not just your app but every other account where a customer used that password.

Signing in by clicking a link emailed to you, instead of typing a password. Common in apps built with AI tools because it is the simplest thing to set up.

What it costs you Usually safer than passwords, because there is nothing to steal or reuse. The weak point becomes the inbox: whoever can read the email can sign in as that person.

Asking for a second proof after the password, usually a code from a phone, so a stolen password alone is not enough.

What it costs you Without it on your own accounts, one reused password anywhere gives somebody the keys to the tool that builds your app. That is a larger hole than anything inside the app itself.

A setting that decides which other websites are allowed to make your app do things on a signed-in visitor’s behalf.

What it costs you Set too loosely, another website can quietly act as your logged-in customer, reading or changing their data without them knowing.

A trick where a visitor who is logged in to your app is made to perform an action on it without meaning to, by visiting a different, malicious page.

What it costs you A customer could change their email or make a purchase they never intended, simply by opening the wrong link while signed in to your app.

A trick where a stranger makes your app fetch something on their behalf, and your app’s server does it while trusting them.

What it costs you Your server can be tricked into reaching internal systems a stranger could never reach directly, including the keys that run your hosting. This is how some large breaches started.

When an app shows text a visitor typed without cleaning it first, so someone can slip in instructions that run inside other visitors’ browsers.

What it costs you An attacker’s code runs as if it were your app, so it can steal what your customers type or take over their signed-in session.

When an app trusts a visitor’s word about which record they are asking for, instead of checking they are allowed to see it.

What it costs you Someone changes a number in the address, say from their order to order 124, and is handed a stranger’s order. Every customer’s data becomes reachable one number at a time.

We check for this, free →

When an app builds a database instruction out of whatever a visitor typed, so a carefully written entry becomes a command instead of plain text.

What it costs you A stranger who types the right thing into a box can read, change or delete your whole database. It is one of the oldest and most damaging faults.

Code that runs on the way in to every request, before the part that answers it. Typically to check who is asking, or to turn somebody away.

What it costs you It is where the check that says "are you allowed in" usually lives, so one missing line here removes the lock from every door at once rather than from one of them.

The contents of a request: what a browser actually sends when somebody submits a form or an app asks for data.

What it costs you Nothing by itself; it is only a word for the contents. It matters because an app that trusts the payload without checking it is how most of the tricks on this page begin.

When your app can be handed any address and will send a visitor onward to it, without checking where.

What it costs you A link that genuinely starts with your own domain, which a customer trusts, lands them on somebody else’s copy of your sign-in page. It is a favourite for stealing passwords.

A specific address your app talks to behind the scenes to fetch or save data, separate from the pages a person clicks through.

What it costs you If one of these addresses hands back data without checking who is asking, a stranger can call it directly and get information the pages would never show them.

A setting that tells a browser which sources of code and images it is allowed to load on your page.

What it costs you Without it, if someone manages to slip code onto your page, nothing stops that code from running. It is a seatbelt: you hope not to need it, but its absence makes a crash worse.

The lock that scrambles what travels between a visitor’s browser and your site so no one in between can read it.

What it costs you Without it, anything your customers type, passwords, card details, can be read by anyone on the same network, and browsers warn people away from your site.

A short instruction sent alongside a page, which a browser reads before showing anything. Invisible to a visitor.

What it costs you Several of the settings that protect your customers are only headers, so their absence is silent. Nothing looks wrong, and nothing is protecting anybody either.

An instruction telling a browser to only ever reach your site over the locked connection, even if somebody types the unlocked address.

What it costs you Without it there is a moment, on the first visit, where a visitor can be pushed onto an unlocked copy of your site before the lock takes effect.

The proof a browser checks to decide your site really is who it claims to be. It is what puts the padlock there, and it expires.

What it costs you An expired one replaces your site with a full-page warning that tells people it is unsafe. Almost nobody clicks past it, and it happens on a date nobody diarised.

The directory that turns your web address into the machine that answers it. Changing it is how a site moves.

What it costs you If the domain itself lapses, your site disappears from the internet entirely, and the reminder usually goes to an inbox nobody reads any more.

The technical wall of text an app shows when something breaks, listing what it was doing when it failed.

What it costs you Shown to visitors rather than hidden, it names your files, your libraries and sometimes your settings. It is a map of your app handed to whoever caused the error.

A ceiling on how often one person can do something: send a message, try a password, ask your app to do work that costs you money.

What it costs you With none, one person with a simple script can repeat a paid action thousands of times overnight. The invoice is how you find out, and it arrives after the money is gone.

A message another service sends your app when something happens, like a payment company telling you an order was paid.

What it costs you If your app does not check the message really came from them, anybody who finds the address can claim a payment succeeded and be handed the goods for nothing.

A small piece of code that runs on demand rather than on a machine you keep running. Most AI-built apps use these for anything that cannot happen in the browser.

What it costs you You pay per run, and they are reachable from the internet by default. One left open that calls a paid service is a bill with no ceiling on it.

Somebody else’s code that your app is built on top of. A typical app has hundreds, most of which nobody chose deliberately.

What it costs you When a fault is found in one, the fix is published and apps that never update keep the fault. Nothing in your app tells you; the news is elsewhere.

A published, numbered record of a specific fault in a specific piece of software, so everybody can refer to the same thing.

What it costs you A number on a list is harmless. What matters is whether your app uses the version it describes, because the record is public before most people have updated.

The response a website gives when a page does not exist. A link that leads to one is a dead end.

What it costs you A visitor on the way to buying who hits a dead end usually leaves. A dead "pricing" or "sign up" link is a lost sale every time someone clicks it.

We check for this, free →

An instruction asking search engines not to list a page. Every builder adds one while a site is being made.

What it costs you Left on after launch, you will never appear in search for anything, including your own name. No error, no warning, and no amount of writing fixes it until it comes off.

We check for this, free →

A file listing your pages, so a search engine can find all of them rather than only the ones it stumbles onto.

What it costs you Without one, a search engine finds your home page and most of your other pages are never looked at. The pages that sell are usually the ones it missed.

We check for this, free →

Google’s measurements of how a page feels to a real visitor: how long before the main thing appears, and whether it jumps around while loading.

What it costs you Slow pages lose people before they see anything and Google ranks them lower, so you get fewer visitors and keep fewer of the ones you get.

We check for this, free →

How much of the time your site actually answers. Not whether it works when you check, but whether it worked at three in the morning.

What it costs you Most founders find out their site was down from a customer, days later, which is both the slowest and the most expensive way to learn it.