your ai-built app works. that's the problem
Founders can now build an app with AI in an afternoon. It looks finished. Underneath sit exposed keys, missing checks and decisions nobody made on purpose. In September UpGuard found 16,326 databases on Supabase, the backend favoured by vibe-coded apps, exposing readable tables. New Medium's tool, Strata, reads what a founder built, puts the risks on a fix list and pulls out what they meant to build, before they raise, hire or leap.
Picture a physiotherapist who builds her own patient-booking app with AI over three weekends. It works. Clinics want it. A developer friend looks it over and says it seems fine. Nobody has checked whether it leaks, or whether it makes the calls she would.
New Medium works in that gap. Its tool, Strata, reads everything a founder built with AI before they build a company on it. Exposed keys, missing checks and untested code go on a fix list. Then it pulls out what the founder meant to make and turns it into one brief their website, deck and funnel are all generated from.
In September UpGuard found 16,326 databases on Supabase, the backend vibe-coded apps lean on, exposing readable tables.
I'd be glad to put founder Brian Lanier in front of you. The full kit, with receipts, is here.
If it's the wrong desk, delete it and the fault is mine.
Trend context
Vibe-coded apps are leaking data at scale. UpGuard's study of 25 September 2026 found 16,326 Supabase databases exposing readable tables, more than half showing signs of personal data. Veracode's 2025 testing found 45% of AI-generated code failed OWASP Top 10 security tests, and the Cloud Security Alliance counted more than 20 documented AI-app breaches in 2025-26. The people shipping this software are increasingly not developers, and can't read the code they've shipped.
About New Medium
Why we exist
AI lets anyone build in an afternoon what used to take a team a quarter. That is a gift and a trap. The thing looks done, so people build companies on it, without knowing what's dangerous inside or whether it decides things the way they would. New Medium exists so that the person who knows the business, not the person who wrote the prompt, stays in charge of what gets built.
How we do it
Investigation first, building second. Strata reads everything a founder built with AI before any new work starts. Exposed keys, missing checks and untested code go on a fix list. The founder's intent becomes one north star (who it's for, what it does, how it sounds), and the website, deck and funnel are each generated from it, so they can't drift apart.
What we do
New Medium makes Strata, an analysis tool for software built with AI, and a spec-driven development framework for teams shipping AI-assisted software in their own repositories. Products: a free Kickoff Kit (a starting-point report and draft project documents from what you've already built); Founder Access (prompts, agents, templates, starter MCP assets and lifetime community membership); and technical due diligence for private equity deal teams buying software companies.
Why it matters
If New Medium vanished at midnight, the expert who vibe-coded their idea would be back to guessing: leap and find out six months in, or stall in doubt. The enemy is "seems fine", the habit of treating a working demo as a finished product and a friend's glance as a review. The stakes are real: in September 2026 UpGuard found 16,326 databases on Supabase, the backend favoured by vibe-coded apps, exposing readable tables. The victims are founders who raise on it and the customers whose data sits behind it.
Who it's for
Non-technical founders and industry experts who built their first product with AI and now have to decide whether to build a company on it. The physiotherapist who knows exactly how a patient booking should work, spent three weekends building the app herself with AI, has clinics asking for it, and lies awake wondering whether it's safe to hand them a login. She knows her business. She can't read her own code.
Proof points
14 of 20 founder-price Founder Access places left, at $49 rising to $79 (company figures, 22 October 2026). Products built through the framework include Care Canvas, a FHIR-aligned telehealth platform, and Pup Tag, a shipped consumer utility (company figures).
Traction & credibility
Three-track offer live: founders, agencies and private equity technical due diligence. Free Kickoff Kit open to any founder at newmedium.dev.
Spokespeople
Brian Lanier
Founder
Designer working to build a more human and connected future.
Talking points
The insight
your ai-built app works. that's the problem
The story
The people building software have changed. Clinicians, accountants and operators are now shipping working products with AI without being able to read a line of the code. New Medium argues the danger isn't that these apps fail; it's that they work. A working demo hides exposed keys, missing checks and decisions nobody made on purpose, and the founder can't tell which parts carry their judgment and which are the AI guessing on their behalf. A developer friend saying "seems fine" answers a code-quality question, not that one. New Medium built its tool, Strata, to read a build before anything else is added to it.
Why it matters
Non-developers are now shipping software that holds real people's data. On 25 September 2026 UpGuard published a study finding 16,326 databases on Supabase, the backend favoured by vibe-coded apps, exposing readable tables, more than half showing signs of personal data. "It works" has stopped being proof of anything. A developer friend saying "seems fine" is a code-quality opinion, not proof the product carries the founder's judgment.
Who does it impact
Expert-founders who built their product with AI and can't read their own code, and the customers whose data now sits inside those apps. What changes: "it works" stops being the test before a raise, a first hire or a first paying customer.
Proof points
The stance is lived in the product: Strata flags exposed keys, missing checks and untested code onto a fix list rather than burying them, and New Medium states openly that its free Kickoff Kit does not replace a technical investigation. Veracode's 2025 GenAI Code Security Report found 45% of AI-generated code failed security tests against the OWASP Top 10; the Cloud Security Alliance counted more than 20 documented breaches in 2025-26, most linked to vibe-coded or AI-assisted apps shipped without review.
CTA
Founders who built something with AI can run it through New Medium's free Kickoff Kit at newmedium.dev for a starting-point report before they build a company on it.
Key facts
- Exposed Supabase databases
- 16,326 exposing readable tables, more than half showing signs of personal data (UpGuard, 25 Sept 2026)
- AI-generated code failing security tests
- 45% failed OWASP Top 10 tests across 100+ models and 80 tasks (Veracode 2025 GenAI Code Security Report)
- Documented AI-app breaches
- 20+ in 2025-26, most linked to vibe-coded or AI-assisted apps shipped without review (Cloud Security Alliance, April 2026)
- Free entry point
- Kickoff Kit at newmedium.dev: starting-point report and draft project documents; not a substitute for a technical investigation
Get in touch
Brian Lanier
Founder
Drop me a note and I'll reply by email.