AI App Builder Audits · AI Development Series
Xano App Audit
Xano is the part everything else is built on. Whatever front end you put in front of it, its endpoints are what the internet can actually reach.
What Xano actually hands you
Xano provides the backend rather than the interface: a real Postgres database, generated REST endpoints, and a visual way of building the logic between them. It is commonly paired with a front-end builder like WeWeb, FlutterFlow or a generated React app.
What a Xano application is made of
- Database PostgreSQL, managed for you
- API REST endpoints, generated per table and hand-built
- Logic The function stack, built visually per endpoint
- Authentication Token-based, configured per endpoint
- Integrations External API calls from within the function stack
- Hosting Xano, with scaling handled for you
Because Xano is the backend, its endpoints are the actual attack surface of your product. Whatever the front end shows or hides is irrelevant to anyone calling the API directly, and the API is documented and reachable.
The good news is that it is real Postgres underneath, so a proper relational data model is possible — and unlike a document store, the database can enforce relationships if you let it. Whether the generated schema uses any of that is the question.
What we consistently find
These are the recurring issues in Xano backends.
Endpoints with authentication switched off
Every endpoint has its own authentication setting, and it is entirely possible — and common — to have most endpoints protected and a few not. The unprotected ones are usually the ones added quickly to solve a problem.
An endpoint without authentication is public to anyone who finds it, and finding it is not hard.
What it costs you: one open endpoint exposing the data behind all the protected ones.Authenticated endpoints that do not check ownership
The more common and subtler failure: the endpoint requires a valid token, then takes a record identifier from the request and returns that record without checking it belongs to the caller.
Your front end only ever asks for the current user's records, so nothing looks wrong. Changing an identifier is all it takes.
What it costs you: customer data exposed to other customers. Reportable under UK GDPR.Function stacks nobody can follow
Business logic is built visually, step by step, per endpoint. It works, but it is difficult to review, impossible to unit test in any conventional sense, and hard to compare against what a similar endpoint does.
The same rule ends up implemented slightly differently in several places, and the differences are where the bugs live.
What it costs you: inconsistent behaviour between endpoints that should agree.A relational database used as a flat one
Xano gives you real Postgres, which will happily enforce relationships, uniqueness and constraints. Generated schemas usually do not ask it to.
Missing indexes on the fields you filter by are the other half of this, and they are the usual reason a Xano backend gets slow before it gets busy.
What it costs you: invalid data the database would have rejected, and avoidable slowness.Where Xano is genuinely good
Xano is a genuinely good product and a sensible choice. Real Postgres, a proper API layer and no servers to manage is a strong combination, and it avoids the data-model problems that come with document stores and proprietary databases.
Genuinely well suited to
- Giving a no-code front end a real, relational backend
- Teams who need an API without managing infrastructure
- Products expected to grow beyond a spreadsheet-shaped data model
- Applications where several front ends share one backend
- Getting to production without hiring a backend developer
Where it needs engineering behind it
- Anything where each endpoint has not been individually checked
- Multiple customers whose data must never mix
- Personal data, health data or payment details
- Logic complex enough that endpoints must agree with each other
- Anything facing a client or investor security review
The honest summary: Xano gives you a better foundation than most of this category, and being the backend means its mistakes are the ones that matter most. Nothing you do in the interface compensates for an endpoint that will answer anybody.
Prefer to watch? The short version of who we are and how we work
Do you need an audit?
Get it looked at if
- More than one customer or organisation uses the product
- It stores personal data of any kind
- It takes payments or sits near anything that does
- You have not gone through your endpoints one at a time
- You are about to promote it, launch it, or raise on it
You are probably fine if
- It is a prototype with no real users
- It holds nothing you would mind losing or leaking
- Every endpoint is read-only over public data
- You are the only person using it
Questions about auditing a Xano build
No, and this is the single most important thing to understand about a backend platform. Your front end is not the only thing that can call your API. The endpoints are reachable directly by anyone, with whatever arguments they choose. Every endpoint has to establish for itself who is asking and what they are entitled to, regardless of how well-behaved your interface is.
Read access to the Xano workspace so we can see the endpoints, function stacks, authentication settings and schema. We do not need to change anything and we will not. If you have a front end as well, we will look at how it uses the API, but the endpoints are the priority.
No, and we would rather say so plainly than pretend otherwise. We build with Claude Code and Cursor, with senior developers designing the system, reviewing every change and testing it. What makes us useful here is not Xano expertise, it is that the thing being audited is PostgreSQL and a REST API, which is what we have been building and securing for years.
Built with something else?
We audit what these tools produce, whichever one you used.
Other AI app builders
- Lovable app audit
- Emergent app audit
- Replit app audit
- UI Bakery app audit
- Bolt app audit
- v0 app audit
- Base44 app audit
- Firebase Studio app audit
- Databutton app audit
- Rork app audit
- a0.dev app audit
- FlutterFlow app audit
- Bubble app audit
- Glide app audit
- Softr app audit
- Adalo app audit
- Retool app audit
- Appsmith app audit
- Budibase app audit
- ToolJet app audit
- Airtable app audit
The audit
Find out what you are sitting on
The AI Code Audit is £495, fixed.
Tell us roughly what you built and how many people use it. If an audit is not the right thing for you, we will say so.
What the report covers:
- Every endpoint, and what it will do for a stranger
- Whether ownership is checked as well as authentication
- Your data model, constraints and indexes
- Whether endpoints that should agree with each other actually do
We reply within one working day.
