HOW TO SECURE A CREATE.XYZ APP

Create.xyz Security Context

Create.xyz turns prompts into React apps with generated databases, serverless functions, and built-in AI integrations (GPT, Claude, image models) — all published to a hosted URL. The platform proxies its built-in AI integrations server-side, which is the right default. The risk concentrates in what the generator adds on top: functions that are publicly callable until you ask for auth, database queries with no per-user scoping, and custom API integrations that the AI sometimes wires up client-side with the key in the bundle. The recurring shape we see is “the prompt said make it work, so the generator made it work — for everyone, authenticated or not.”

Security Checklist

1. Add auth to every generated function

Create.xyz functions are reachable at their public URL as soon as the app is published. Anyone who reads your bundle can find the endpoint paths and call them directly with curl. Prompt explicitly for an auth check at the top of every function that reads or writes user data, then verify by calling the endpoint logged out — you want a 401, not data.

2. Lock down AI-backed endpoints — they are free inference for strangers

Any function that forwards a request to GPT, Claude, or an image model is an inference endpoint you pay for. Without auth and rate limiting, anyone who finds the URL gets free AI at your expense — and scripts do find them. Require a logged-in user, cap requests per user per hour, and cap the input length server-side. This is the single most expensive gap in Create.xyz apps.

3. Scope database access per user

Generated database queries default to “fetch by ID” with no ownership filter. That is BOLA in AI-generated CRUD: user B changes an ID in the URL and reads user A’s record. Every query that touches user-owned data needs a where owner = current_user clause server-side — prompt for it explicitly, then test it (item 13).

4. Keep custom API keys out of the client bundle

Built-in integrations are proxied by the platform, so those keys stay server-side. Custom integrations you add via prompt are the danger: the AI sometimes generates the API call in a client component, which puts the key in the JavaScript bundle. Check the deployed app with the Token Leak Checker, and search the bundle for key prefixes (sk-, sk_live_, AIza, re_). Any third-party call with a secret key must go through a serverless function.

5. Validate input server-side in every function

Generated forms validate in React; generated functions often trust the body. Anyone can bypass the form with a direct request. Prompt for validation at the top of every function:

const Body = z.object({ amount: z.number().positive().max(10000) })
const data = Body.parse(body) // throws on invalid

Without this, a request can carry a 100MB string, a negative amount, or an unexpected field that maps to a sensitive column.

6. Sanitize user content rendered as HTML or Markdown

Create.xyz apps frequently render user- or AI-generated text as Markdown or raw HTML. Stored raw and rendered with dangerouslySetInnerHTML, that is stored XSS. Sanitize at render time (DOMPurify or equivalent) and keep Markdown rendering in safe mode. See LLM-rendered HTML/Markdown for the AI-content variant.

7. Strip role and privilege fields from update payloads

If your users table has a role or is_admin column, a generated “update profile” function that accepts arbitrary fields lets a user promote themselves. Allowlist the updatable fields server-side; never spread the request body into an update.

8. Rate-limit expensive and auth endpoints

Beyond AI endpoints (item 2), add per-IP and per-user limits on login, signup, password reset, and anything that calls a paid external API. Track attempts in a table and reject over threshold. Create.xyz does not add throttles for you.

9. Return generic errors in production

Generated error handling tends to return the exception message, which can leak query shapes, file paths, and stack details. Wrap function handlers and return {"error": "Internal server error"} to clients; log the real error server-side.

10. Validate file uploads

If your app accepts uploads: cap size, allowlist MIME types, and regenerate filenames server-side. The bug shape is an “image upload” that accepts an HTML or SVG file which then serves from your domain as same-origin script. See file upload zip-slip / XXE.

11. Verify webhook signatures

If a function receives webhooks (Stripe, Resend, GitHub), verify the signature before trusting the payload. Generated webhook handlers usually read event.type from the body and act on it — anyone can POST that body.

12. Audit OAuth redirect URIs

If you wired Google / GitHub OAuth, restrict the provider’s redirect URI list to your production URL only. Leftover dev URLs and wildcards are an account-takeover surface. See SSRF / open redirect / OAuth.

13. Test with two accounts (BOLA)

Sign up as user A, create a record, copy its URL or ID. Sign up as user B and request it. If B sees A’s record, your database scoping is wrong (item 3). Repeat for every user-owned resource type.

14. Re-test after every regeneration

This is Create.xyz-specific and easy to miss: re-prompting a page or function can silently regenerate code and drop a fix you made earlier — the auth check you added last week may not survive “make the dashboard faster.” After every regenerate, re-run items 1, 3, and 13 at minimum. Treat regeneration like a deploy, because it is one.

15. Run a security scan

The Vibe Code Scanner covers the deploy-side patterns; the full VibeEval scan adds BOLA, role-escalation, and open-endpoint probes against your published Create.xyz URL.

Common Vulnerabilities in Create.xyz Apps

Publicly Callable Functions

Every generated function is an open endpoint until auth is added. The bug ships when the prompt asks for functionality and never mentions who is allowed to call it.

Free-Inference AI Endpoints

An AI-backed function without auth or rate limits is a free LLM proxy for anyone who finds the URL. The bill lands on your account.

Unscoped Database Reads

Fetch-by-ID with no ownership check. Works in the demo with one user; leaks everything with two.

Keys in the Client Bundle

Custom API integrations generated into client components ship the secret key to every visitor’s browser. Rotate any key that ever appeared in the bundle.

Related Resources

Free Self-Audit Suite

Five free scanners.

Token Leak Checker

Find exposed API keys in your deployed bundle.

Vibe Coding Vulnerabilities

Full risk catalogue across AI builders.

Automate Your Security Checks

VibeEval scans your Create.xyz application against every category above plus 305 more probes. Findings ship with fix prompts you can paste back into Create.xyz for one-shot remediation — and re-run after every regeneration to catch what the AI silently undid.