Three public incidents, all involving AI-assisted development, all preventable by controls that predate AI entirely. The interesting part is not that they happened — it is how ordinary the missing pieces were.
One: the database open to the internet
A vulnerability in a popular app-building platform exposed data across 170+ applications built on it. The root cause was not exotic: applications were generated without row-level security rules, leaving the database readable by anyone who found the endpoint.
The control: access rules written per table, and a test that calls your own API with no credentials to confirm they work. Ten minutes, and it is the single highest-value check on this page.
Two: the private images that were not private
An app holding sensitive user photographs leaked roughly 72,000 of them. Storage was configured to be reachable without authentication — a default that is convenient during development and catastrophic once real users arrive.
The control: private buckets by default, signed time-limited URLs for access, and a rule that no storage container becomes public without someone deliberately deciding it should.
Three: the agent that deleted production
An AI coding agent with access to a production database deleted it. The agent behaved as instructed; the problem was that the instruction could reach production at all.
The control: environment separation. Development tooling gets development credentials. Nothing that can be prompted should hold write access to production, and backups should be restorable — which means a restore that has actually been tested, not merely scheduled.
The pattern
All three are configuration, not code quality. No amount of reviewing the generated logic would have caught them, because the fault was in what surrounded it: who can reach the data, what the defaults were, which environment the tool was pointed at.
That is precisely the category AI cannot supply for itself. A model writes what you asked for. It does not know your bucket is public, that your agent is pointed at production, or that nobody wrote the access rules — because none of that is in the file it is editing.
Three questions worth answering today
Can an unauthenticated request read your data? Is any storage container public that should not be? Does any development tool hold production credentials?
If any answer is "I would have to check", check. All three incidents above began as something nobody had checked. A Reality Check answers all three, and the rest, in a week.
This is the part we do — the crossing from a demo to a system that survives production.