Your AI-Built Login Page Is the Easiest Way Into Your App. Add This Before You Launch.

Claude Code just added a login screen to your web app.

It’s a big moment. Real accounts. Real users. It finally feels legit.

It’s also the easiest place in your entire app to break into.

Why is an AI-built login page so easy to hack?

Because unless you asked, AI probably didn’t limit how many times someone can try a password. A bot can sit on your login page and try thousands of passwords, nonstop, until one works.

This isn’t an edge case. OWASP, the nonprofit behind the most widely used list of web security risks, flags any login that “permits brute force or other automated attacks” as a top risk (OWASP Top 10). And AI coding tools miss security steps often. In Veracode’s 2025 study of more than 100 AI models, AI-written code introduced a security flaw in 45% of tasks.

Once someone gets in, they are your user. They see that person’s data, their payments, everything.

How often do hackers get in with passwords?

Often. Verizon’s 2025 Data Breach Investigations Report found stolen or abused passwords were how hackers got in 22% of the time. That makes it one of the most common ways in.

“My users have passwords, so I’m fine”

This is what most people get wrong.

Many people reuse the same password everywhere. In a Google and Harris Poll survey, two in three people said they recycle passwords across accounts. When one of those sites gets breached, the email and password combo ends up on a list.

Hackers have those lists. They don’t guess. They take a leaked email and password and try it on your app. Security people call this credential stuffing.

So your user’s password can look strong and still be the one that lets a stranger in.

What is rate limiting?

Rate limiting caps how many times anyone can try to log in. After too many wrong tries, the account slows down or locks for a few minutes.

This isn’t just my opinion. It’s the official standard. The US government’s digital identity guidelines, NIST SP 800-63B, say login systems must limit failed attempts on an account. The same guidelines say new passwords should be checked against lists of passwords that already leaked in breaches.

A real user who forgets their password just waits a few minutes or resets it by email. A bot trying 10,000 passwords gets stopped.

Doesn’t Supabase already do this?

Partly. If your app uses Supabase for logins, Supabase already limits sign-in requests by internet address: 150 requests every five minutes by default. That slows down one computer. But attackers spread their tries across many addresses, so a limit per account still matters.

Supabase also offers leaked password protection, which rejects passwords found in known breaches. It’s available on the Pro plan and above, and it’s a setting you turn on yourself.

That’s the rule I want you to remember: a prompt asks AI to do something. A setting makes it stick.

What’s changing: security is now your selling point

Not long ago, if you wanted a login page, you hired a developer. Now you ask AI and it’s there in a minute.

That’s the opportunity. Anyone can build an app with real users and real payments.

It also means the job of protecting those users moved to you. The builders who win in this new economy are the ones customers trust with an account and a credit card. Most people shipping AI-built apps never check this. You can.

Your move: add rate limiting before you launch

1. Paste the prompt below into Claude (or whatever AI built your app).
2. Turn on the setting. If you’re on Supabase Pro, turn on leaked password protection in your Auth settings.
3. Test it. Log out. Type the wrong password on your own test account over and over. If you never get blocked or slowed down, it isn’t working. Paste what happened back into Claude.

Add rate limiting to my login and password reset pages so each account only gets a limited number of attempts. After too many wrong attempts, make the person wait a few minutes or reset their password by email. Then block any password that has appeared in a known data breach, and show me what you changed.

Limit first. Login second.

This one helps you stand out: you launch with the protection most AI-built apps skip, and you can tell customers their accounts are safe with you.

AI lets anyone build. Owning what you build means protecting the people who trust it.

Inside Leveraging AI, we build web apps people pay for, and we lock them down before launch.

Come build with us.