AI App Builder Audits · AI Development Series
Softr App Audit
Softr puts a decent interface on data you already keep somewhere else. The audit question is what that somewhere else will hand out if asked directly.
What Softr actually hands you
Softr builds client portals, directories and internal apps on top of a data source you already maintain. It is deliberately a front end: it does not hold your data, it presents it.
What a Softr application is made of
- Data source Airtable most commonly, or Google Sheets, Postgres, MySQL
- Application Softr's hosted front end, no exportable code
- Access control User groups and per-block visibility conditions
- Users Softr's own user management, or an external list
- Logic Conditional filters and actions on blocks
- Hosting Softr only
Because Softr is a presentation layer, its security depends on two separate things: what Softr shows, and what the underlying source will give up independently. People almost always check the first and almost never check the second.
The usual arrangement is that Softr connects to Airtable with a key that has access to the whole base. Softr then filters what each user sees. That works, provided nothing else can reach that base — but the key exists, the base is not itself restricted per user, and any other integration, automation or leaked token has the same broad access.
What we consistently find
These are the recurring issues in Softr and Airtable setups.
A connection with access to everything
The token connecting Softr to Airtable typically has full read and write across the base, because narrowing it makes things stop working. All per-user restriction happens in Softr, above that connection.
The base itself therefore has no concept of who is asking. Anything else holding that token — another tool, an automation, a former contractor — sees everything.
What it costs you: one credential exposing the entire base regardless of your portal rules.Visibility conditions doing the work of permissions
Softr blocks can be shown or hidden per user group, and filters can restrict which records a list displays. Whether that is genuine protection or merely presentation depends on how the block and its filters are configured.
The failure mode to look for is a detail page reachable by its address: the list correctly shows only your records, but the individual record page will happily render somebody else's if you navigate to it.
What it costs you: records reachable by anyone who changes an identifier in the address bar.Airtable being asked to be a database
Airtable is a superb spreadsheet-database hybrid and a poor transactional database. It has record limits, rate limits on its API, no enforced relationships and no protection against simultaneous edits.
Portals built on it work beautifully until the base gets large or busy, at which point pages get slow, the API starts refusing requests, and records begin colliding.
What it costs you: a portal that degrades sharply once the base grows.Where Softr is genuinely good
Softr solves a real and common problem: you keep your operational data in Airtable, and you need clients or staff to see part of it without giving them the base. Building that portal by hand is weeks of work that earns you nothing.
Genuinely well suited to
- Client portals over data you already keep in Airtable
- Internal directories and dashboards
- Membership and community sites
- Getting a portal live in days rather than months
- Teams whose operations genuinely run on Airtable
Where it needs engineering behind it
- Portals where users must never see each other's records
- Personal data, health data or financial records
- Bases approaching Airtable's record or rate limits
- Anything needing a real audit trail
- Data with relationships that must stay consistent
The honest summary: Softr is a sensible answer to a real problem, and its weakness is structural rather than a flaw: it can only restrict what it is asked to display. Whether your data is actually protected is a question about the base underneath, which is the part nobody audits.
Prefer to watch? The short version of who we are and how we work
Do you need an audit?
Get it looked at if
- Clients or external users log into the portal
- The base holds personal or commercially sensitive data
- Users must not be able to see each other's records
- Several tools connect to the same Airtable base
- The base has grown large or the portal has slowed down
You are probably fine if
- It is internal and everyone could see the data anyway
- It holds nothing you would mind losing or leaking
- It is read-only over public information
- A handful of trusted colleagues use it
Questions about auditing a Softr build
It is the right start, but it only covers what the portal does. The question we also ask is what the Airtable base would return to anything else holding the connection token, and whether an individual record page can be reached directly by changing an identifier. Those are the two gaps that portal-level filtering does not close.
View access to the Softr application so we can see the blocks, user groups and filters, and read access to the Airtable base or database behind it. We do not need write access and we will not change anything.
No, and we would rather say so plainly than pretend otherwise. We build with Claude Code and Cursor, with senior developers designing the system, reviewing every change and testing it. What makes us useful here is not Softr expertise, it is that the thing being audited is a data source, a set of credentials and a permission model, which is what we have been working with for years.
Built with something else?
We audit what these tools produce, whichever one you used.
Other AI app builders
- Lovable app audit
- Emergent app audit
- Replit app audit
- UI Bakery app audit
- Bolt app audit
- v0 app audit
- Base44 app audit
- Firebase Studio app audit
- Databutton app audit
- Rork app audit
- a0.dev app audit
- FlutterFlow app audit
- Bubble app audit
- Glide app audit
- Adalo app audit
- Retool app audit
- Appsmith app audit
- Budibase app audit
- ToolJet app audit
- Xano app audit
- Airtable app audit
The audit
Find out what you are sitting on
The AI Code Audit is £495, fixed.
Tell us roughly what you built and how many people use it. If an audit is not the right thing for you, we will say so.
What the report covers:
- What the underlying base exposes to anyone holding the connection
- Whether portal filtering is protection or only presentation
- Whether individual records can be reached directly
- Whether your data source will hold up as it grows
We reply within one working day.
