My App Got Hacked — What Do I Do? A Step-by-Step Response

If your app was just hacked, or you strongly suspect it, take a breath — panic leads to mistakes, and you have a clear set of moves to make. This is an ordered response plan: contain the damage first, then figure out what happened, then notify who needs to know, then close the hole so it can't happen again. Work top to bottom; the order matters.

Step 1 — Contain it before you investigate

Your first job is to stop the bleeding, not to understand it. Assume the attacker may still have access, and rotate every credential that could be exposed: database keys, API keys, admin passwords, and third-party tokens. If data is actively leaking or the attacker has ongoing access, it's reasonable to take the affected feature — or the whole app — offline temporarily. A short outage is far cheaper than a longer breach.

Step 2 — Figure out what was accessed

Once contained, look at your logs — server, database, and authentication logs — for unusual queries, unfamiliar IP addresses, large data reads, and access at odd times. You're trying to answer two questions: how did they get in, and what did they reach. If you have little or no logging, you can't rule things out, so assume the worst case for any data that was reachable through the vulnerability. (This is exactly why monitoring matters before an incident, not just after.)

Step 3 — Identify the root cause

Most breaches of AI-built apps trace back to a small set of causes: an exposed key, a missing database access control (Row Level Security off), or an endpoint with no authorization check. Find the specific hole. If you fix the symptom without finding the cause, you'll be back here soon. Our writeups on exposed API keys and missing RLS cover the two most common.

Step 4 — Notify who needs to know

If personal data was exposed, you likely have obligations. Many data-protection laws require notifying affected users, and sometimes regulators, within a set timeframe. The exact rules depend on where you and your users are located, so treat notification as probably required and get proper advice rather than hoping it blows over. Being upfront also protects the trust you'll need to keep those users. This article isn't legal advice; for a real breach, talk to someone qualified in your jurisdiction.

Step 5 — Close the hole and check for others

Fix the root cause, then confirm there aren't more like it. A single exposed key or missing access control is rarely alone — the same rushed launch that produced one usually produced others. Run a full scan of your app to surface the rest, and add monitoring so the next attempt shows up in minutes instead of weeks. Paste your live URL into Sayver's free website security scan to find the remaining exposures.

After the fire is out

Once you've contained, investigated, notified, and fixed, do the boring thing that prevents the next one: make a security scan part of every launch and every significant change, and keep basic monitoring on. Getting hacked once is a bad week; getting hacked the same way twice is a pattern you can avoid. If you're rebuilding your defenses from scratch, start with how to secure a vibe-coded app.