AI writes most startup code now, and it reproduces the insecure patterns in its training data at machine speed.
On a cloud-telephony platform.
Managed databases and buckets leak data when rules check that a caller is logged in but never that they own the record.
On a crypto-neobank.
The main app enforces auth well, but a sibling service on the same estate does not.
On a healthcare care-navigation startup.
Individually-medium findings combine into a critical breach.
On a contract-AI SaaS.
When a server trusts a caller-supplied email, domain, or identity claim as proof of who you are, anyone can become anyone.
On an AI lending platform.
MCP servers expose powerful tools to AI agents.
On a customer-support AI startup.
Self-registration that trusts a client role field or defaults new accounts to admin hands attackers privilege on signup.
On an AI voice-agent platform.
A live key shipped in a JS bundle, an APK, or a public repo is public.
On a property-management SaaS.
Shipping AI features creates attack surfaces classic appsec misses.
On an insurtech company.
An OTP with no rate limit, no expiry, and a code that never rotates makes brute force a certainty.
On a legal-AI platform for law firms.
On a student-housing CRM.
On a cardiac-telehealth clinic.
On a veterinary clinic-management SaaS.
On an EV-charging network.
On a healthcare voice-AI company.
On a real-estate CRM.
On a payments-orchestration platform.
On an AI-accounting fintech.
On a durable-medical-equipment marketplace.
On a coliving operator.
On a merchant-underwriting fintech.
On a diagnostics-AI company.
On a furnished-housing platform.
On a healthcare recognition platform.
On a large property marketplace.