AI without review: when generated code exposes a database

A real case, with a lesson that does not depend on the tool: according to MyBroadband, the CEO of a South African coffee chain with 132 stores built an internal management dashboard with AI. The company’s sensitive data ended up in plain sight for anyone.

What was reported

According to MyBroadband, cited by International Cyber Digest, the sensitive data was stored in the source code of the login screen. Anyone who looked at that code could read it. The dashboard’s URL was discovered from photos that employees had posted on Instagram.

No sophisticated attack was needed. Looking at the code of a public page was enough.

The problem is not AI

Using AI to write code is not the mistake. It is one more tool, and it can speed up the work a lot. The mistake is publishing what it generates without reviewing it.

There are three things a professional checks before going to production, and that a tool alone usually skips:

1. What reaches the browser. No sensitive data should end up in the HTML or the JavaScript the user downloads. If the data has to exist, it lives on the server, behind a session.
2. Who can see what. A management panel needs permissions: which role sees sales, which one sees employee data, and who can change what.
3. What gets indexed and archived. An unprotected page can end up in search engines and public archives. What is published by mistake stays out there.

What to ask whoever builds your software

This applies to a studio, a freelancer or your own team:

• Who reviewed the code before it went live?
• What data reaches the user’s browser?
• How is access to the admin panel controlled?
• Are there security tests before every release?

If the answer is silence or “the AI did it right”, that is a warning sign.

So what do we do with AI?

We use it every day, with judgment. It helps us prototype, write tests, explore options and save time on repetitive work. But no change reaches production without someone reading it, understanding it and testing it. That responsibility is not handed over to a tool.

This also applies to a site like ours. The verification pipeline runs linters, tests and reviews before every release, and that is what keeps a mistake from reaching your customers.

To wrap up

AI does not replace the judgment of whoever builds a system. What this case shows is what happens when what a tool produces is trusted blindly. Use it to go faster, but not to skip the review.

If you want to talk about your project, get in touch. You talk directly with the person building it.