Performance and security check-and-fix sample report: a made-up online course company

Please read first. This is a made-up report. The company, the service and every number in it are invented, and it is not the result of a real check. But we picked each problem in it from real incidents that made the news this year. Those real incidents are listed with sources at the bottom, under What actually happened this year.

Written 2026-10-26 · bytecreo

The company (made up)

A team of six runs an online course site with a monthly subscription. It has 12,400 members, and 2,100 of them pay every month. They built it in two months with an AI coding tool, without a developer, and launched this spring.

Member data lives in an outside database service (Supabase), payments go through a card payment provider, and an "AI study helper" that answers members' questions runs on an outside AI company, billed by usage. They asked for a check because data leaks kept making the news and nobody had ever looked at their service.

One-page summary

As it stood, anyone could read the details of all 12,400 members, and a stolen key could run up thousands of dollars in AI charges within days. We fixed the three most urgent problems, checked again, and both were closed. The first screen on phones also went from 8.4 seconds to 2.3 seconds.

Risk	What was wrong	If left alone	After the fix
Red	1. Member data open to anyone Without logging in, anyone could read and change the names, emails, phone numbers, courses and payment history of all 12,400 members	Someone could copy or alter the whole member list	Green Outside requests are refused
Red	2. The admin master key inside the website files The files every visitor downloads contained the admin key	That key can read and delete every record	Green Key replaced and kept only on the company's server
Red	3. Change a number, see someone else's receipt Changing the number at the end of a receipt link showed another member's name, address and amount paid	Members can see each other's details	Green Only your own receipt opens
Red	4. The AI key exposed, with no limit The AI study helper's key was also in the website files, with no usage limit or alert	If someone takes it, a bill of about $230 a month can turn into tens of thousands of dollars in days	Green Limits and alerts set, key kept on the company's side
Yellow	5. The admin screen Anyone who knew the address got the login screen, and wrong passwords were never blocked	Someone can try passwords leaked from other sites until one works	Green Locked for 15 minutes after 5 wrong tries, plus a phone check
Yellow	6. A fake "payment complete" works The site never checked whether the payment provider's notice was genuine	Paid courses can be opened without paying	Green Fake notices are refused
Yellow	7. Slow on phones On a slow connection, 8.4 seconds before the first screen appeared, and 6.2 MB downloaded up front	Visitors stare at a white screen and leave	Green 2.3 seconds, 0.9 MB
Yellow	8. The database service's October 30 change From that day, new tables cannot be read by the site unless they are opened up on purpose	A new feature added with an AI tool quietly stops working	Green Opening new tables is now part of the build steps, tested in advance

Change 8 does not make anything riskier. It just breaks features if you don't know about it. It also does not close problems like number 1 that are already open.

The three to fix first, and why

Lock the member data and remove the master key (1 and 2). This is the road by which every member's data can leak today. This year, the same thing turned up in more than 16,000 services built on the same database service. In Korea, where this company operates, the revised privacy law that took effect on September 11 allows fines of up to 10% of revenue for serious leaks (reported).
Close other members' receipts (3). Any logged-in member can do it, so it is the easiest one to go wrong. In Korea's 2025 leak reports, 12% of hacking cases were web gaps like this one, where changing a value in a link shows someone else's data (reported).
Stop runaway AI charges (4). This one costs money straight away. This year a three-person company was billed $82,314 in two days through a single stolen AI key (reported).

We fixed the remaining 5 to 8 later the same week.

How each one was fixed

Problem	Why it happened	How we fixed it	Time taken
1. Member data	Each feature added with the AI tool created new tables, but the "see only your own" lock was only on the first two. The five later tables had no lock at all	Put "own records only" and "admin only" locks on all seven tables, and moved admin features to the company's server	1.5 days
2. Master key	To build the admin screen quickly, the website used the admin key directly	Issued a new key and retired the old one. The new key lives only on the company's server	Half a day
3. Other members' receipts	Receipts were looked up by number alone, with no check that the number belonged to the logged-in member	Check the owner every time a receipt opens, and use numbers that are hard to guess instead of counting up	1 day
4. AI charges	The website called the AI company directly, with no usage limit	Route calls through the company's server, with 50 a day per member, a monthly cap and an alert at 80% of the cap. Key replaced too	1 day
5. Admin screen	Left as it was first built	Lock for 15 minutes after 5 wrong tries. Admins confirm on their phone after the password	Half a day
6. Payment notices	The part that checks the notice's signature was empty	Check the signature, then ask the payment provider for the payment status before opening the course	Half a day
7. Phone speed	The first screen pre-loaded part of an intro video (about 3 MB) and used 12 photos at full size	Load the video only when tapped, shrink photos to phone size, load what the first screen needs first	2 days
8. October 30 change	It was a change on the service's side, and nobody saw the notice	Make "open the new table" part of every build step, and switch the new setting on early to test	Half a day

Checked again after the fixes

Item	Before	After	How we checked
Member data readable without login	All 12,400 members	0	Requested each of the seven tables from outside. All refused
Secret keys in the website files	2	0	Searched all website files again. The old keys are refused
Other members' receipts	Open	Refused	Two test members tried each other's numbers
AI usage	No limit	50 a day per member · monthly cap · alert at 80%	Checked that request 51 is blocked and the alert email arrives
Guessing admin passwords	Unlimited tries	Locked 15 minutes after 5 wrong tries · phone check	Entered a wrong password six times
Fake payment notice	Paid course opened	Refused	Sent an unsigned notice and an altered one
First screen on phones	8.4 seconds	2.3 seconds	Simulated a slow phone connection, measured three times, took the middle value
Download for the first screen	6.2 MB	0.9 MB	Same method
New features after October 30	Could stop working	Working	Switched the new setting on early and created a new table

After the fixes we went through sign-up, paying for a course, watching it, asking the AI study helper and logging in as admin in a real browser. Everything worked.

Still open (for the company to decide)

Backups sit in the same place as the live database. This year an AI coding tool deleted live data and backups together. Where to keep backups separately, and the cost, is the company's call.
The AI coding tool still has access to the live database. We recommend letting it work only on a development copy.
The actual wording of the privacy policy, and when to delete the data of members who leave.
For members who reuse passwords from other sites, offer login with a phone check as an option.

What actually happened this year

These are the real incidents we used to pick the problems above. The numbers match the problems in the table. Items marked "reported" were checked through news coverage only.

1 and 2 September 2026, security firm UpGuard: among services built on the same database service (Supabase), 16,326 had tables anyone could read. Source
1 and 2 February 2026, security firm Wiz: a key in the website code of Moltbook, a service built with AI, gave read and write access to its whole database. 35,000 email addresses and 1.5 million authentication tokens were exposed. Source
2 June 2026, Korea's Personal Information Protection Commission fined Coupang 624.7 billion won (about $470 million). The commission said the breach came "not from advanced hacking but from a lack of basic safety management". Source (Korean)
3 July 2026, a Korean government startup program: details hidden on screen were included in the server's responses, and data on about 5,000 selected applicants was scraped (reported).
3 and 5 May 2026, Korea's 2025 leak statistics: 12% of hacking cases were web gaps such as changing values in a link, 8% were break-ins to admin pages, and half of the private companies penalised were small and medium businesses (reported).
4 February 2026, security firm Truffle Security: Google Maps keys that were meant to be safe to put on a web page became keys that pay for AI (Gemini) once Gemini was switched on in the same account. They found 2,863 live keys on public web pages. Source
4 March 2026, The Register: a three-person company that usually spent about $180 a month was billed $82,314 in two days through a stolen Google AI key (reported).
4 and 5 August 2026, AI research group METR: an internal app an employee built with AI let requests through whenever its login check failed, an AI key was stolen, and about $600,000 worth of usage was consumed (free credits, so no money was actually paid). Source
5 August 2026, Korean retailer GS Retail fined 12.8 billion won: it did not block mass login attempts from the same source, and accounts were taken over with passwords leaked elsewhere (reported).
6 April 2026, GitHub security advisory (CVE-2026-41432): an open-source tool that sells AI usage did not verify payment notices, so usage could be topped up without paying. Source
7 April 2026, Shopify: for every 0.1 second slower a store loads, the share of visits that turn into purchases tends to be about 3.5% lower (a pattern, not proof of cause). Source
8 Supabase notice: from October 30, 2026, "new tables are not opened up automatically" also applies to existing projects. Existing tables and locks do not change. Source
Overall October 21, 2026, AI coding tool Lovable: the tool's security certifications do not certify every app built with it, and responsibility for an app's personal data lies with the company that built the app. Source
Still open 1 and 2 February 2026, DataTalks.Club: an AI coding tool deleted the live servers and the automatic backups together, and the cloud provider restored them about a day later. Source
Law September 11, 2026, Korea's revised privacy law took effect: repeated or serious leaks can be fined up to 10% of revenue, and the law now names the company's representative as the person ultimately responsible (reported).

How a real check works

We agree on the scope and get your written permission.
We never take real customer data. We work on a test copy.
We check, pick what to fix first, fix it, and check again the same way to show before and after.
We do not run hacking attempts, and a check alone is not a promise that nothing will go wrong later. We report only what we fixed and what we checked again.
The first three clients get the check free, on condition that we can publish the results as a case study.

Want us to check your service the same way, fix it, and check it again?
Book a first 30-minute call