AI App Builder Audits · AI Development Series
Databutton App Audit
Databutton gives you a proper backend rather than pushing everything into the browser. That is the right shape. It also means every endpoint has to defend itself.
What Databutton actually hands you
Databutton generates full applications with a genuine separation between front end and back end, aimed particularly at data-heavy and analytical work where Python is the natural choice.
What a Databutton application is made of
- Frontend React with TypeScript
- Backend Python, using FastAPI
- Data Managed storage, or a database you connect
- Secrets Managed within the platform
- Hosting Included, deployed from the platform
- Export Source code available to you
Having a real backend is a meaningful advantage: there is one place where access rules can be enforced properly, rather than scattered through browser code. The catch is the same as with any FastAPI application — protection is opt-in per route. An endpoint without an authentication dependency attached is simply public, with no warning and no error.
Databutton applications also tend to accumulate endpoints quickly, because adding one is the natural way to make anything work. The ones added late in a build are the ones we find unprotected.
What we consistently find
These recur in generated FastAPI applications.
Endpoints with no authentication attached
FastAPI protects a route only when you attach a dependency that checks the caller. Generated code gets this right on the obvious routes and misses it on exports, reports, administrative actions and anything added to fix a problem at the end of a session.
We go through every route and record what it requires before it will answer.
What it costs you: one public endpoint exposing the data behind all the protected ones.Authenticated but not authorised
The subtler and more common version: the endpoint confirms you are logged in, then takes a record identifier from the request and returns that record without checking it belongs to you.
Every honest user requests only their own data, so nothing ever looks wrong. Changing a number in a request is all it takes.
What it costs you: customer data exposed to other customers. Reportable under UK GDPR.Analysis that reloads everything, every time
Because Databutton is often used for data work, we frequently find endpoints that pull an entire dataset into memory and compute over it on each request. With test data this is instantaneous.
At real volume it is slow, expensive, and eventually falls over. The fix is usually to push the work into the database rather than the application, which is straightforward once identified.
What it costs you: an application that degrades sharply as your data grows.Where Databutton is genuinely good
For anything analytical, Databutton is a sensible choice: Python is genuinely the right language for that work, and getting a usable interface on top of it without building one by hand saves real time.
Genuinely well suited to
- Data-heavy and analytical applications
- Teams who already write Python
- Internal reporting tools for a small trusted group
- Prototyping something that will later be built properly
- Getting a front end onto existing Python work
Where it needs engineering behind it
- Multiple separate customers whose data must never mix
- Anything holding personal data, health data or payment details
- Workloads that grow beyond what fits comfortably in memory
- Anything your business would genuinely suffer without
- Applications that must be maintained over years
The honest summary: Databutton starts from a better architecture than most generators, which means the problems it leaves are narrower and more fixable. They are also entirely invisible until somebody goes looking, because a missing check never announces itself.
Prefer to watch? The short version of who we are and how we work
Do you need an audit?
Get it looked at if
- More than one customer or organisation uses it
- It stores personal data of any kind
- It has grown noticeably slower as data accumulated
- Endpoints have been added over time by different people
- You are about to promote it, launch it, or raise on it
You are probably fine if
- You are the only person who uses it
- It holds nothing you would mind losing or leaking
- It is an internal experiment and treated as one
- It is a throwaway you will rewrite when the idea is proven
Questions about auditing a Databutton build
The code, exported from Databutton or in a repository you control, and read-only access to whatever database it uses. We do not need your Databutton account, we will not deploy anything, and we will not change your application.
It depends what it can reach. Internal tools frequently have broader data access than customer-facing ones, so the consequences of a mistake or a compromised account can be larger rather than smaller. If it only reads data nobody would mind leaking, you are probably fine.
No, and we would rather say so plainly than pretend otherwise. We build with Claude Code and Cursor, with senior developers designing the system, reviewing every change and testing it. What makes us useful here is not Databutton expertise, it is that Databutton produces React, Python and FastAPI, which is what we have been building and fixing for years.
Built with something else?
We audit what these tools produce, whichever one you used.
Other AI app builders
- Lovable app audit
- Emergent app audit
- Replit app audit
- UI Bakery app audit
- Bolt app audit
- v0 app audit
- Base44 app audit
- Firebase Studio app audit
- Rork app audit
- a0.dev app audit
- FlutterFlow app audit
- Bubble app audit
- Glide app audit
- Softr app audit
- Adalo app audit
- Retool app audit
- Appsmith app audit
- Budibase app audit
- ToolJet app audit
- Xano app audit
- Airtable app audit
The audit
Find out what you are sitting on
The AI Code Audit is £495, fixed.
Tell us roughly what you built and how many people use it. If an audit is not the right thing for you, we will say so.
What the report covers:
- Every API endpoint, and what it will do for a stranger
- Whether authorisation is checked as well as authentication
- How the data work will behave at ten times its current size
- Whether it can be maintained and changed safely
We reply within one working day.
