The part of AI-built software you should be asking about.
AI writes code that reads correctly and can still leave a door open, and the mistakes it makes are not the ones a reviewer is expecting to find. Security is what we did before we did this, so what the software exposes and who can reach your data get settled while it is being designed, and gone through again before it is handed over. It is part of the build and never quoted separately.
- Before anything is built: what an attacker would want here, what they would try, and what that means the design has to do.
- What the software exposes to the internet, and closing anything that does not need to be open.
- Where your data sits, who can reach it, and what an attacker would get if they did.
- That keys and passwords stay on the server and never reach anyone's browser.
- Permissions: who can see what, and what a compromised account can do.
- Anything touching money, personal data, or who is allowed in gets read line by line rather than skimmed.
- Known vulnerabilities in the third-party components we used, checked before handover rather than at the first incident, and anything left unfixed comes to you in writing with the reason.
- What happens under the kind of input nobody expects, including deliberate abuse.
- Logs that let you reconstruct what happened, without recording things that should never be written down.