What is going on
Codex can build an app that works when you click through it yourself. That does not mean it is safe for strangers. The problems that matter most do not show up in a quick test: a key in the wrong place, a page anyone can open, or a database anyone can read.
Error messages you might see
Common causes
- Keys and passwords written into the code or committed to the repository.
- Checks on who may see or change something exist only in the screen, not on the server.
- Data from forms is used without checking it.
- The database lets any signed-in user read other people's data.
- Error messages show internal details to visitors.
How to fix it
Check each of these before you tell anyone the app is live.
- Search the project and its git history for keys, tokens and passwords. If one was ever committed, create a new one and stop using the old one.
- Keep secrets in environment variables on the host, and keep the
.envfile out of git. - For every page or action that shows or changes data, try it while signed out and while signed in as a different user.
- Make sure the server checks who is asking, not only the page that shows the button.
- Look at the rules on your database. Each person should be able to read only their own rows.
- If the app takes payments, check that it confirms payments on the server and never trusts the browser.
- Back up the database and test that you can restore it.
A review by a developer covers these in one call and gives you a list of what to change.
Getting help takes about a minute
No hiring, no back and forth. A real person looks at your app.
-
1
Describe it
Tell us what you need in plain words. You don't have to be technical or have an account to start.
-
2
Free 15-minute call
A verified developer calls you. Many tasks are sorted right there, and it costs nothing.
-
3
Pay after you approve
If there is more to do, you get one fixed price up front. You pay only once you are happy.
Real people, reviewed by hand
Developers who do this every day
Every developer is approved by our team before they can take a task. Describe yours and the first one who is free picks it up.
Get help
Sage Fulcher
ReactJs · Django · Ruby on Rails · graphQL · typescript · node
Hey I'm Sage! Im a Boston area software engineer who grew up in South Florida. Ive worked at a ton of cool places like a telehealth kidney care startup that took part in a billion dollar merger (Cricket health/Interwell health), a boutique design agency where I got to work on a ton of exciting startups including a photography education app, a collegiate Esports league and more (Philosophie), a data analytics as a service startup in Cambridge (MA) as well as at Phillips and MIT Lincoln Lab where I designed and developed novel network security visualizations and analytics. I've been writing code and furiously devoted to using computers to make people’s lives easier for about 17 years. My degree is in making computers make pretty lights and sounds. Outside of work I love hip hop, the Celtics, professional wrestling, magic the gathering, photography, drumming, and guitars (both making and playing them)
rayush33
react · react native · javascript · nodejs · nextjs · mongodb · html · css
JavaScript (React.js, React Native, Node.js) Developer with demonstrated industry experience of 4+ years, actively looking for opportunities to hone my skills as well as help small-scale business owners with solutions to technical problems
Jaime Orts-Caroff
kotlin · android
I'm a Senior Android developer, open to work in various fields
Questions
Is code written by an AI less safe?
Not by itself. The risk is that nobody read it closely. The same review is worth doing for code written by a person.
What is the most common serious mistake?
Secrets in the code or the repository, and data that any signed-in user can read.
