AI can build an app in a weekend. Protecting your customers' data is a different job.

July 18, 2026 · 5 min read

Earlier this year, security researchers at a firm called Red Access went looking at apps built the new way, where you describe what you want to an AI and it writes the software. They found more than two thousand of them sitting on the open internet holding real business data, with no password and no sign-in. Anyone who found the web address could read all of it. The apps were not built by careless people. Many ran inside real companies and passed their security reviews while the data was wide open.

This is not a story about AI being bad. We build TurfDispatcher with AI every single day, and we are glad to. It is a story about a gap that is easy to miss, and why it matters more for a lawn care business than for almost anyone else.

The gap nobody warns you about

AI closed the distance between having an idea and having working software. That part is real, and it is genuinely great. What it did not close is the distance between working software and software that can safely hold someone else's customer data. Those are two different skills, and only one of them got easier.

The research backs this up. Veracode tested more than a hundred AI models on security-sensitive code and found that 45 percent of what they wrote shipped with a well-known security hole, and that number has not improved in two years of newer, smarter models. The reason these holes slip through is simple. A security control can look completely correct and still do nothing at all, and nothing you can see on the surface tells you which.

The software still works. It logs the job, sends the invoice, and looks finished. The hole does not show up in anything you can see. That is the whole problem.

Why this lands harder on a lawn care business

Think about what your software actually knows about your customers. Their names, phone numbers, and email addresses. The address of the house. The code to the back gate. When you were last there and when you are coming back. What you sprayed, and where. What they still owe you.

That is not a list of preferences. Put together, it is a map of when a house sits empty and how to get into the yard. If that leaks, it is your customer's safety at stake. And in most states, the law makes you, not the software company, the one who has to tell your customers it happened.

This is not hypothetical

These are not warnings about what could go wrong someday. They already went wrong, in public, in the past year.

Moltbook, January 2026. A new online platform whose founder said plainly that he did not write a single line of code and built the whole thing with AI. A security researcher opened the app's own web page, found the key to its database sitting right there in the code, and saw that the main protection had been left switched off by default. That one gap left about 4.75 million records open to anyone who looked, including 1.5 million access tokens and 35,000 email addresses. It took minutes to find. The app looked like it was working perfectly the entire time.

Tea, July 2025. An app that held women's selfies and photo IDs left a storage folder online with no password on it. Around 72,000 images spilled out, along with more than a million private messages about deeply personal things. There was enough detail in the data to tie it back to real people and real locations. The lawsuits started within days.

These are not two unlucky apps. Researchers went looking and found more than two thousand AI-built business apps left open in the same way, across every kind of industry. In a separate test of more than a hundred AI models, 45 percent of the code they produced shipped with a known security hole. The tools are fast and genuinely useful. They also leave the doors unlocked by default, and they do not tell you they did.

Why it hits a small operator hardest

It is tempting to read all of this as a big-company problem. It is the opposite. Verizon's 2025 breach report found the same short list of plain mistakes behind breach after breach: stolen passwords, no second step at login, and access that a vendor left wide open. Ransomware showed up in 44 percent of the breaches they studied. None of that needs you to be a large target. It needs a door left unlocked.

What is different for you is what happens after. A large company has a security team, insurance, and lawyers to absorb the hit. A solo operator, or a crew running two trucks, has none of that. The same leak a big company writes off as a line item can be the thing that ends your customers' trust in you for good. And in most states, the law makes you, the business that collected the data, the one who has to tell those customers it happened. Not the app you bought.

You do not have to understand any of this to protect yourself. If you take one thing from this, take this question, and ask it of any company that wants to hold your customers: if you had a break-in tomorrow, what of mine could get out, and would you tell me? How they answer tells you most of what you need to know.

← More from the blog · How We Protect Your Data