the blog
What AI leaves open.
Plain-English writing on the security holes AI coding tools leave behind, and how to close them.
February 2, 2026 · 4 min read
A Client Asked If Their App Was Secure. I Realized I'd Never Actually Tried to Break It.
I had a confident answer ready. Then I actually stopped and thought about what that confidence was based on, and it wasn't much.
Read itFebruary 1, 2026 · 4 min read
"We Use HTTPS, So We're Secure" Is Only Half True
HTTPS does one job, and it does it well. It has nothing to do with the two questions that actually decide whether your app is safe: who can read your database, and does your login actually check anything.
Read itJanuary 31, 2026 · 4 min read
The Day Your App Goes From 'Just Me Testing' to 'Real People Signing Up'
Nothing about your code changes the moment you post a public link. Everything about your risk does. Here's what to check in the hour before that switch flips.
Read itJanuary 30, 2026 · 5 min read
The One-Page Security Checklist for Anything Built With an AI Coding Tool
A stack-agnostic checklist of the security mistakes I keep finding in apps built with AI coding tools, across Supabase, Firebase, and plain Postgres. Bookmark it and recheck it on every project.
Read itJanuary 29, 2026 · 5 min read
The Page Checked My Login. The API Never Did.
A plain-English walkthrough of the most common gap I keep finding in AI-generated apps: a login-gated page sitting directly on top of an API that will answer anyone who asks it nicely.
Read itJanuary 28, 2026 · 4 min read
One Security Review Doesn't Cover the Life of Your App
A codebase that changes every week can't be secured once and left alone. It's the same reason a car needs more than one oil change over its life, and it's why the AI coding tools themselves quietly stopped shipping "review once" features.
Read itJanuary 27, 2026 · 5 min read
Scanner or Audit? What You're Actually Paying For
A plain-English breakdown of what an automated scanner actually catches, what it misses, and the three questions that tell you whether you're paying for a scan or a real audit.
Read itJanuary 26, 2026 · 4 min read
Vibe Coding Just Turned One. Its Security Habits Didn't Grow Up With It.
Collins named it the word of the year. Karpathy coined it almost exactly a year ago. Here's what actually changed on the security side in twelve months, and what's still stuck exactly where it started.
Read itJanuary 25, 2026 · 6 min read
Rate Limiting Your Login Form: An Afternoon Fix That Closes an Easy Door
An unprotected login form isn't a subtle vulnerability, it's an open door. Here's how to put a basic rate limit on your login and signup forms in an afternoon, no security background required.
Read itJanuary 24, 2026 · 5 min read
What Bolt.new Actually Locks Down Before You Hit Publish
A look at what Bolt.new checks automatically before your app goes live as of early 2026, and the security decisions that no scan can make for you.
Read itJanuary 23, 2026 · 5 min read
The Share Link That Almost Showed Someone Else's Data
I built a small internal tool so clients could check their own status without logging in. Months later, out of habit, I edited one character in a URL and saw a different client's data load without a fight.
Read itJanuary 22, 2026 · 4 min read
The AI Wrote Tests. That Doesn't Prove It's Secure.
A passing test suite proves the feature works for the person it was built for. It proves nothing about the person it wasn't built for, and that's the person deciding whether it's actually safe.
Read itJanuary 21, 2026 · 5 min read
The API Checklist for Apps That Live on a Home Screen, Not a Browser Tab
When there's no browser session to lean on, a handful of quiet protections disappear all at once. Here's what actually changes for a mobile-first or app-shell product, and what to check before you ship one.
Read itJanuary 20, 2026 · 4 min read
The Handoff Checklist: What to Revoke and Rotate Before a New Developer Touches Your App
A contractor leaves the project and their access almost never leaves with them. Here's the actual checklist I run: what to revoke, what to rotate, and what to check before anyone new touches the codebase.
Read itJanuary 19, 2026 · 5 min read
One .env File Is a Map, Not a Key
I found an exposed .env on a small vibe-coded app. Here's what was actually inside it, and why a leaked config file usually hands over every service the app talks to, not just one key.
Read itJanuary 18, 2026 · 4 min read
Same Bug, Different Bill: Fixing It Before Launch vs After the Breach
The technical fix barely changes whether you catch a security gap before launch or after a breach. What changes is everything wrapped around it, and trust is the part that never comes back at the price it left at.
Read itJanuary 17, 2026 · 5 min read
Should I Pay for a Security Review Before I Have Paying Customers?
A builder asked me this after shipping a weekend project with real signups but no revenue yet. Here's the honest way to think about it, and the two questions that actually decide it.
Read itJanuary 16, 2026 · 4 min read
Everyone's Shipping Apps Now. Almost Nobody's Checking Who Can Read the Database.
Two weeks into 2026, I keep meeting non-engineers with a live, database backed app they built over the holidays. Here's what actually changed in the eleven months since "vibe coding" didn't have a name yet, and what still hasn't.
Read itJanuary 15, 2026 · 4 min read
How to Test Your Own App for the Bug That Lets One User See Another's Data
It has a technical name, insecure direct object reference, but the test for it is simple enough to run in ten minutes with two free accounts and zero security background.
Read itJanuary 14, 2026 · 5 min read
What Lovable Actually Checks Before You Publish, and What It Still Doesn't
Lovable added a real security scan to its publish flow last year. Here's exactly what it catches, what prompted it, and what still slips through even with it turned on.
Read it