CREATE.XYZ SECURITY CHECKLIST

Create.xyz is a text-to-app builder that generates React apps, databases, and serverless functions from prompts, with built-in AI integrations (GPT, Claude, image models) proxied by the platform. The most common security issues come from two patterns: generated functions are publicly callable until auth is explicitly added, and generated database access is not scoped per user — so a working demo becomes a data leak the moment a second user signs up. A third pattern is unique to prompt-driven builders: regenerating a page can silently drop a fix you made earlier. The checklist below is what we look for first when we audit a Create.xyz app.

Treat Critical as launch-blocking. High is week-one. Medium is the cleanup once you have users.

How to use this checklist

Walk it once against the published app with two logged-in accounts and a logged-out browser tab, ticking items as you go. After each fix, sign in as user B and try to read user A’s data, then call the fixed endpoint logged out. After the whole list passes, run a black-box scan against the deployed URL — and re-walk the Critical section after every regeneration.

Critical (fix before launch)

1. Require auth on every generated function

Why it matters. Create.xyz serverless functions are reachable at their public URL from the moment the app is published. Prompts describe functionality, not access control, so the generator ships open endpoints by default.

How to check. Enumerate the function endpoints from the app’s network traffic, then call each one from a logged-out session with curl. Any data-returning or state-changing endpoint that answers with a 200 is open.

How to fix. Prompt for an auth check at the top of every non-public function and verify the logged-out call now returns 401. Keep a list of intentionally public endpoints so the exceptions are explicit.

2. Lock down AI-model endpoints — auth plus rate limits

Why it matters. Functions that forward to GPT, Claude, or image models are paid inference under your account. An unauthenticated AI endpoint is free inference for anyone who finds it, and endpoint URLs are discoverable from the client bundle. This is the fastest way a Create.xyz app runs up a surprise bill.

How to check. Call each AI-backed endpoint logged out. Then, logged in, script 50 rapid requests. If both succeed, you have neither auth nor rate limiting.

How to fix. Require a session, cap requests per user per hour, cap input length server-side, and alert on usage spikes in your model provider’s dashboard.

3. Scope every database query to the current user

Why it matters. Generated CRUD reads fetch by ID with no ownership filter. Any authenticated user who changes an ID in a request reads another user’s record — BOLA in AI-generated CRUD, the most common finding in AI-generated apps.

How to check. Sign in as user A, note a record’s ID, sign in as user B, and request the same ID. The response must be 403 or 404, not 200.

How to fix. Add an ownership condition (owner_id == current_user) to every query over user-owned data, server-side. Repeat the two-account test for each resource type.

4. Check the bundle for leaked API keys

Why it matters. Create.xyz proxies its built-in AI integrations server-side, so those keys are safe. Custom integrations added via prompt are not: the generator sometimes places the API call in a client component, shipping the secret key in the JavaScript bundle to every visitor.

How to check. Run the Token Leak Checker against the published URL, and grep the bundle for known prefixes (sk-, sk_live_, AIza, re_, ghp_).

How to fix. Move every secret-key call into a serverless function. Rotate any key that ever appeared in the bundle — it is already compromised.

5. Validate input server-side in every function

Why it matters. Generated React forms validate client-side; generated functions frequently trust the posted body. Direct requests bypass the form entirely, opening injection on writes and logic abuse on anything numeric.

How to check. POST malformed payloads directly to each function: oversized strings, negative amounts, unexpected extra fields.

How to fix. Add a schema validation step at the top of every function and reject invalid input with a 400 before touching the database.

6. Sanitize user content rendered as HTML or Markdown

Why it matters. Create.xyz apps often render user- or AI-generated text as Markdown or HTML. Stored raw and rendered unsanitized, one user’s crafted comment executes as script in every other viewer’s session — see LLM-rendered HTML/Markdown.

How to check. Submit <img src=x onerror=alert(1)> and a Markdown link with a javascript: URL through every user-content field, then view as another account.

How to fix. Sanitize at render time (DOMPurify or equivalent), keep the Markdown renderer in safe mode, and never pass user content to dangerouslySetInnerHTML unsanitized.

High (fix in the first week)

7. Strip privilege fields from update endpoints

If the users table has role or is_admin, a generated update function that accepts arbitrary fields lets users promote themselves. Allowlist updatable fields server-side.

8. Rate-limit auth endpoints

Login, signup, and password reset need per-IP throttles. Without them, credential stuffing runs at full speed against your user base.

9. Verify webhook signatures

Generated webhook handlers read the event type from the body and act on it. Verify Stripe/Resend/GitHub signatures before payments or side effects go live.

10. Return generic errors in production

Generated handlers tend to return raw error messages that leak query shapes and internals. Log details server-side; return {"error": "Internal server error"} to clients.

11. Restrict OAuth redirect URIs

If OAuth is wired up, remove dev URLs and wildcards from the provider’s redirect list. Production domain only.

12. Disable email enumeration in the auth flow

Signup, password reset, and magic-link flows must return identical responses for “user exists” and “user does not exist.”

Medium (fix when you can)

13. Cap file upload size and types

If the app accepts uploads: size cap, MIME allowlist, filenames regenerated server-side. An HTML file served from your domain is stored XSS.

14. Remove demo and seed data

Generated apps often ship with sample users and records. Delete them before launch; they are guessable credentials and noise in your data.

15. Restrict who can edit the Create.xyz project

Anyone with edit access can re-prompt away your security fixes. Keep the editor list minimal.

16. Monitor AI endpoint usage

Watch your model provider’s usage dashboard for spikes. A sudden jump usually means someone found an endpoint you thought was private.

17. Document each function’s access model

A written record of which endpoints are public, authenticated, or owner-scoped gives you something to diff against after regeneration.

After every Create.xyz regeneration

This section matters more on Create.xyz than on most platforms. Re-prompting a page or function regenerates code, and the new code can silently drop an auth check, an ownership filter, or a sanitization step you added earlier.

• Re-call every previously fixed endpoint logged out — confirm 401s still hold.
• Re-run the two-account BOLA test on user-owned resources.
• Re-grep the bundle for API keys — a regenerated integration can move a call client-side.
• Re-test rate limits on AI-backed endpoints.
• Diff against your documented access model (item 17).

Common attack patterns we see in Create.xyz apps

The free inference endpoint. An AI chat function shipped without auth; a scraper finds the URL in the bundle and routes its own workload through it. The owner finds out from the invoice.

The unscoped fetch. getOrder(id) with no ownership check; a signed-in user iterates IDs and dumps every order in the database.

The client-side integration. A prompt added a custom email API; the generator called it from a React component with the key inline. The key is in every visitor’s DevTools.

The regeneration wipe. The founder fixed auth on the admin function, then re-prompted “redesign the admin page.” The regenerated function shipped without the check.

Related Resources

How to Secure Create.xyz

Step-by-step guide for hardening a Create.xyz app — function auth, AI endpoint protection, database scoping, and the regeneration workflow in long form.

Is Create.xyz Safe?

In-depth analysis of Create.xyz’s defaults — what the platform handles, what the generator leaves open, and what we find when we audit a typical app at launch.

Automate Your Checklist

A checklist tells you what to look for. A scanner tells you what’s actually broken in the deployed app right now. VibeEval drives a real browser through your published Create.xyz app, attempts the cross-user BOLA, open-endpoint, and key-leak attacks above, and reports what got through — with the function or query to fix. Re-run it after every regeneration.