the blog
What AI leaves open.
Plain-English writing on the security holes AI coding tools leave behind, and how to close them.
August 1, 2026 · 4 min read
How to Check Whether Your Invite Link Is Actually Meant for Just One Person
An invite link is usually built to bring one specific person onto a team or account. If nothing stops it from being reused, forwarded, or accepted twice, it quietly becomes a much broader door than intended.
Read itJuly 31, 2026 · 5 min read
What OpenAI's Codex Security Actually Does, Beyond the Headline Numbers
Codex Security builds a codebase-specific threat model rather than running one generic rule set. Worth understanding exactly what that means, and what its own reported numbers do and don't tell you.
Read itJuly 30, 2026 · 4 min read
The Free Trial That Never Actually Expired
A founder was confident his 14-day trial gate was solid because the interface enforced it perfectly. The interface was never the thing actually deciding who got premium access.
Read itJuly 29, 2026 · 4 min read
Myth: "I Used a Reputable Database Provider, So It's Secured by Default"
Supabase and Firebase are both genuinely solid, well-built platforms. Neither one decides, on your behalf, who's allowed to read your specific tables. That decision is still yours to make, every time.
Read itJuly 28, 2026 · 4 min read
How to Check Whether Your App Will Talk to Literally Any Website That Asks
CORS is one of those settings that quietly decides which other websites are allowed to make requests to your app on a visitor's behalf. Left wide open, the answer becomes: all of them.
Read itJuly 27, 2026 · 4 min read
A One-Time Deep Audit vs Continuous Shield: Which Actually Fits Where You Are
One is a thorough, one-time look at your app exactly as it exists today. The other checks every new thing your AI tool ships, on an ongoing basis. Here's how to actually tell which one you need.
Read itJuly 26, 2026 · 4 min read
Q&A: My Free Scan Came Back Clean. Do I Still Need Anything Else?
A clean result is genuinely good news, and a fair question to ask what it does and doesn't mean before deciding you're done. Here's the honest answer, not the one that sells you something you don't need yet.
Read itJuly 25, 2026 · 5 min read
Where the AI-App-Security Conversation Actually Stands Right Now
A dictionary word of the year, a string of real incidents, and nearly every major AI coding tool shipping its own security tooling within a year. Here's the honest state of things, pieced together rather than reacting to any one headline.
Read itJuly 24, 2026 · 4 min read
How to Check Whether "Deleted" in Your App Actually Means Deleted
A lot of apps don't really delete anything when a user clicks delete, they hide it. That's often a completely reasonable design choice. It's only a problem when nobody checks whether the hidden version is still reachable anyway.
Read itJuly 23, 2026 · 5 min read
What Claude Code's Built-In Security Review Actually Catches
Anthropic added a /security-review command directly into Claude Code, plus a deeper research-preview capability since. Worth understanding exactly what runs when you use it, and where it stops.
Read itJuly 22, 2026 · 4 min read
What Running Our Scanner on a Bunch of Real Live Apps This Week Actually Showed Me
Since launch, I've watched a steady stream of real founders paste in real URLs. The pattern from a year of manual audits held up exactly the way I expected, and one thing surprised me anyway.
Read itJuly 21, 2026 · 4 min read
Myth: "My App Is Too Small to Be Worth Anyone Attacking"
This one assumes an attacker is choosing your app specifically. Most of what actually finds a small app first isn't a person who's heard of you at all, it's an automated scanner that doesn't know or care how big you are.
Read itJuly 20, 2026 · 4 min read
How to Check Whether Someone Can Just Edit the Price Your App Charges Them
If the price or plan a customer pays is decided anywhere the browser can influence it, it can usually be changed before the request ever reaches your server. Here's how to check whether that's true of your own checkout.
Read itJuly 19, 2026 · 4 min read
The Exact List Harbova's Free Scan Checks First, Written Out Plainly
No vague marketing language, just the actual list. Here's precisely what Vibe Check looks for when you paste in a URL, so you know exactly what a clean result does and doesn't tell you.
Read itJuly 18, 2026 · 5 min read
The Folder That Quietly Hands Out Your Entire Commit History
A .git folder sitting publicly reachable on a live site isn't a small leak. It can be your app's entire source code history, old commits included, sometimes with old secrets that were removed from the code but never from the history.
Read itJuly 17, 2026 · 4 min read
A Fixed-Price Audit vs Hiring a Freelance Pentester: What Actually Differs
Both get someone to actually test your app instead of just scanning it. The real differences are in scope, price certainty, and how well the person doing it understands what AI coding tools tend to get wrong.
Read itJuly 16, 2026 · 4 min read
Q&A: What Does Harbova's Free Scan Actually Check, and What Doesn't It?
I'd rather be precise about this than let anyone assume a clean scan means more than it does. Here's exactly what the free Vibe Check covers, and where a deeper look picks up from there.
Read itJuly 15, 2026 · 4 min read
Every AI Coding Tool Added Security Checks This Year. Here's What They Still Leave Out.
Cursor, Bolt, Replit, Claude Code, and OpenAI's Codex have all shipped their own built-in security tooling over the past year. It's genuinely good news, and it doesn't close the specific gap I built Harbova around.
Read itJuly 14, 2026 · 4 min read
How to Run Your First Security Scan and Actually Understand What It Tells You
Pasting a URL into a scanner is the easy part. Here is how I'd read the results, in plain English, so a report full of technical-sounding findings actually tells you what to fix first.
Read itJuly 13, 2026 · 5 min read
I built a security scanner for AI-built apps. Here is what it finds on almost every one.
Vibe coding is amazing. It is also quietly shipping the same four holes over and over. Here is what they are, why they happen, and how to close them.
Read it