Incident file Nº 001 · 17 Oct 2026
Five open doors in AI-built apps
An AI tool can build you a working app in an afternoon. Keeping it safe with real users is a different job. In the last two years, apps have leaked photos, payment keys and private data, and in every case below nobody broke in. Someone found a door that was left open.
The facts, with sources
| Fact | Source |
|---|---|
| 45% of code from more than 100 AI models had a known security flaw. | Veracode, GenAI Code Security Report, July 2025 |
| 170 of 1,645 apps from one builder's showcase had tables anyone could read or write. | CVE-2025-48757 (2025) |
| 71% of about 156,000 iPhone apps had a secret written into the code. | Cybernews research, Oct 2024 (via TechRadar) |
| About 72,000 images were taken from an old storage bucket of a dating safety app. | Company statement, July 2025 (dating safety app breach) |
| An AI coding agent deleted a founder's live database during a code freeze. | Reported July 2025 (Tom's Hardware, heise): AI agent deleted a production database |
| Certificates now last at most 200 days, falling to 47 days by 2029. | CA/Browser Forum ballot SC-081v3 (certificate lifetimes) |
Run the five checks
Each takes about two minutes, and none of them needs you to read code.
Get a free evidence report
Tell us your site's address. We run passive checks only, the same ones in our videos, and send you what we find with the evidence: timestamps, status codes, screenshots. No call, no login, no obligation.
Our inbox opens this week. Until then, message @velfoundry on Instagram with your site's address. We reply in writing.