AI-built websites: what to check before launch

The preview is only one environment

Consider a small site with a contact form and a document upload. The form can work while its upload folder is publicly readable. This is an illustrative failure mode, not a finding about any particular AI tool.

List the production hostname, upload storage and email service. Check what an unauthenticated visitor can retrieve using harmless files you own. Do not extend the check to a hosting provider or another customer's assets.

A hidden field is still client input

A browser can submit values the interface does not offer. Ask the maintainer where file type, size and destination are checked on the server. Inspect the production bundle for credentials; a server environment variable may still be copied into a client build.

If a real secret was published, removing the visible string is not enough. Revoke or rotate it and examine its use. Keep the value out of the report and shared screenshots.

Write down what was actually checked

Keep the deployed version, target, observation and fix owner together. A code review and an external check answer different questions. Neither should quietly stand in for the other.

Mingxi's standard service concerns the agreed unauthenticated public target. Source review, logged-in functionality, business-logic testing and AI-model evaluation are not included. Confirm the scope before ordering.

Practical checklist

• Identify the production target and owner.
• Use harmless test uploads, not customer files.
• Check browser-visible secrets and server validation.
• Record exclusions alongside findings.

A common question

Does using AI to build a site make it unsafe?

Not by itself. Assess the code and deployed configuration. The choice of coding tool is neither evidence of a vulnerability nor proof of security.