Security Checklist for Claude AI-Generated Applications

Common Security and Operational Gaps in Claude-Coded Apps

A developer who has been shipping with Claude Code for a while has compiled a checklist of security blind spots that frequently appear in AI-generated applications. The core observation is that Claude Code optimizes for working code, not for surviving contact with real users in production environments.

Critical Security Vulnerabilities

• API Cost Exploitation: API routes without rate limiting can allow someone to run up your AI costs overnight.
• Payment Webhook Forgery: Webhooks that accept events without verifying signatures can be faked to simulate successful purchases.
• Authentication Flaws: Storing tokens in localStorage exposes them to XSS attacks, leading to mass account compromise. Sessions that live forever mean stolen tokens grant permanent access.

Production Scaling Issues

Problems that work fine in development but emerge in production include:

• No database indexes, causing queries to slow down after a few thousand rows.
• No pagination, leading to attempts to load entire database tables into memory.
• No connection pooling, which can cause applications to crash during the first traffic spike.

The developer notes: "Claude doesn't think about scale unless you make it think about scale."

Input Handling and API Key Exposure

• SQL injection vulnerabilities remain a classic threat, and Claude won't warn you about them.
• API keys in client-side code should be considered compromised the moment you deploy.

Operational Gaps

• No health check endpoint means you might only discover your app is down when users report it.
• No logging in production leaves you debugging blind when something breaks.
• No environment variable validation at startup can cause silent failures with no error messages.
• No backup strategy risks data loss from a single bad migration. The developer advises: "ensure you git your projects and commit after every major build and keep the git private if you don't want them public."

Access Control and Code Quality

• Admin routes that only check login status without verifying admin privileges.
• CORS configured to accept requests from anywhere.
• No TypeScript on AI-generated code, allowing property typos and wrong shape access to pass silently until a user hits an untested path. "Claude writes with confidence. It doesn't mean the code is correct."

Implementation Solution

The developer provides a practical solution: "If you want Claude Code to follow these automatically, just paste the checklist into your CLAUDE.md file at the project root. Or add it to ~/.claude/CLAUDE.md for global rules that apply to everything you build. Claude reads it on every session and treats it as standing instructions."

The final advice: "Ship fast. But ship with your eyes open... better strengthen your base rather than feeling sorry later."