AI App Builder Audits · AI Development Series
Glide App Audit
Glide turns a spreadsheet into an app in minutes. The thing worth checking is how much of that spreadsheet ends up on each user's phone.
What Glide actually hands you
Glide builds applications directly on top of a data source you already have — a Google Sheet, an Excel file, or its own tables. For turning an existing spreadsheet into something usable on a phone, it is genuinely excellent and very fast.
What a Glide application is made of
- Data source Google Sheets, Excel, Glide Tables or Big Tables
- Application Glide's own runtime, no exportable code
- Access control Row Owners and column-level permissions
- Sync model Data is synced down to each device
- Logic Computed columns and actions
- Hosting Glide only
The architectural fact that governs Glide security is that it is an offline-capable app: to work quickly and to work without a connection, it downloads data to the device. What it downloads is decided by your configuration, not by what the screens happen to display.
Glide's mechanism for restricting this is Row Owners. When a column is marked as a row owner, only the matching user receives those rows. If it is not configured, filtering a screen by user does exactly nothing for security — the full table has already been sent, and the filter is just deciding what to draw.
What we consistently find
These are the issues we find in Glide applications.
Row Owners not configured
This is the finding, and it is extremely common. The app shows each person their own records because the screen is filtered by the signed-in user. The device has the entire table.
Everything in that sheet — every customer, every salary, every note — is retrievable from the device by anyone who cares to look, regardless of what the app chooses to display.
What it costs you: your whole dataset on every user's phone. Reportable under UK GDPR.Columns that should never have left the sheet
Spreadsheets accumulate columns: internal comments, cost prices, contact details, working notes. When the sheet becomes an app, all of it comes along unless columns are explicitly protected.
The app shows four fields. The device received twenty-six.
What it costs you: commercially sensitive columns exposed to everyone with the app.A spreadsheet asked to behave like a database
Sheets have no enforced types, no relationships and no protection against two people editing the same row at once. As the app gets used by more people, rows get overwritten, formats drift, and formulas break silently.
Glide Tables and Big Tables improve on this considerably, and moving is often the single most useful change an app can make.
What it costs you: data quietly corrupting as usage grows.Where Glide is genuinely good
Glide is very good at what it is for. Turning a spreadsheet a team already maintains into something usable on a phone, in an afternoon, with no developer involved, is a genuinely valuable thing and it beats the alternative of everyone editing the sheet directly on a small screen.
Genuinely well suited to
- Turning an existing spreadsheet into a usable mobile app
- Field and operational tools for staff
- Directories, checklists and simple data capture
- Internal apps where all users may see all the data anyway
- Replacing a shared spreadsheet, which is usually worse
Where it needs engineering behind it
- Anything where users must not see each other's records
- Personal data, health data, payroll or customer contact details
- Apps used by people outside your organisation
- Data with real relationships and consistency requirements
- Anything needing an audit trail
The honest summary: Glide is excellent for the job it was designed for, which is an internal app over data your team could mostly see anyway. It becomes risky the moment it is used for data that has to be kept apart, because keeping data apart is a setting rather than a default.
Prefer to watch? The short version of who we are and how we work
Do you need an audit?
Get it looked at if
- Different users must see different records
- The source sheet contains personal or commercially sensitive data
- People outside your organisation use the app
- You cannot say whether Row Owners is configured
- The underlying sheet has grown large or unreliable
You are probably fine if
- Everyone using it could see all the data anyway
- It holds nothing you would mind losing or leaking
- It is a small internal tool for a trusted team
- It is read-only over public information
Questions about auditing a Glide build
That is the assumption that causes the problem. Filtering decides what the app draws on screen; it does not decide what was sent to the device. Unless Row Owners is configured on the relevant column, the whole table is already on the phone and the filter is cosmetic. It is the single most important thing to get right in Glide and one of the easiest to miss.
View access to the app in Glide so we can see the data configuration, Row Owners and column settings, and sight of the underlying sheet or tables. We do not need to change anything and we will not.
No, and we would rather say so plainly than pretend otherwise. We build with Claude Code and Cursor, with senior developers designing the system, reviewing every change and testing it. What makes us useful here is not Glide expertise, it is that the question being asked is who can reach which data, which is what we have been answering for years.
Built with something else?
We audit what these tools produce, whichever one you used.
Other AI app builders
- Lovable app audit
- Emergent app audit
- Replit app audit
- UI Bakery app audit
- Bolt app audit
- v0 app audit
- Base44 app audit
- Firebase Studio app audit
- Databutton app audit
- Rork app audit
- a0.dev app audit
- FlutterFlow app audit
- Bubble app audit
- Softr app audit
- Adalo app audit
- Retool app audit
- Appsmith app audit
- Budibase app audit
- ToolJet app audit
- Xano app audit
- Airtable app audit
The audit
Find out what you are sitting on
The AI Code Audit is £495, fixed.
Tell us roughly what you built and how many people use it. If an audit is not the right thing for you, we will say so.
What the report covers:
- Whether Row Owners actually restricts what reaches each device
- Which columns are being sent that should not be
- Whether your data source is holding up as a database
- What would be exposed if someone examined a device
We reply within one working day.
