Databutton is safe to build with, but a generated app carries the same risks as any AI-built full-stack app. The two that matter most are secrets ending up in code that reaches the client or the repo, and data access that is not properly restricted at the database or server. The app running correctly is not evidence that either is handled.
The risks that actually matter
Hardcoded secrets
Keys placed inline to make an integration run can reach the client bundle or a committed repo.
Unrestricted data access
Generated data layers often skip the authorization that stops one user reaching another's data.
Missing input validation
Endpoints frequently trust user input without checking it.
How to secure a Databutton app
- Keep secrets in Databutton's secret storage and out of client code.
- Enforce access checks on the server, and configure database access rules.
- Validate input on every endpoint that takes it.
- Scan the app for inline secrets before you share or launch it.