The Security Problem With AI-Generated Competition Apps

Here is an uncomfortable fact about the wave of AI-generated apps flooding every niche, Islamic events included: studies of AI-generated code consistently find that a large share of it contains security weaknesses — and the people shipping vibe-coded apps are, almost by definition, not the people who would notice.

Your Registration Form Is a Database of Children

Think about what a Quran competition app actually collects. Children’s full names and dates of birth. Parents’ phone numbers and emails. Home cities. Sometimes photos, sometimes madrasah affiliations, sometimes health notes for event day. That is precisely the category of data that privacy law protects most fiercely — and precisely the data a hastily generated app leaves exposed in an unsecured database, an open API endpoint, or a spreadsheet dumped somewhere the prompt never thought about.

The organiser rarely finds out from the developer. They find out from an angry parent, or a journalist.

Vulnerabilities Nobody Is Looking For

Human-built software gets security wrong too — but a real engineering process has layers designed to catch it: code review, dependency auditing, penetration testing, an actual person accountable for the fix. Vibe coding removes every layer at once. The AI generates plausible-looking authentication; nobody checks whether it actually authenticates. It imports packages that sound right; nobody checks whether they’re abandoned, hijacked, or hallucinated outright. The app works in the demo — and ‘works in the demo’ becomes the entire security audit.

The Maintenance Cliff

Security is not a launch-day property; it decays. Dependencies age, vulnerabilities get published, platforms change their rules. A maintained product gets patched. A vibe-coded product gets abandoned the moment its creator’s attention (or AI subscription) moves on — while masjids keep feeding children’s data into it for years.

What Responsible Looks Like

We hold a simple line: any system that touches participant data must have a human who read the code, a review process that challenged it, and a maintenance commitment that outlives the excitement of launch week. That is the standard behind Qiraah and everything else we run — because the first duty of anyone serving the Quran community is not innovation. It is amanah.