the blog
What AI leaves open.
Plain-English writing on the security holes AI coding tools leave behind, and how to close them.
January 13, 2026 · 4 min read
I Took Over a Client Project. The Old Debug Flag Was Still Bypassing Payment.
A handoff, a quick look through the code before touching anything, and a single boolean that had been quietly letting every checkout through unpaid for who knows how long.
Read itJanuary 12, 2026 · 4 min read
"My App Is Too Small to Be a Target" Is Not How This Works
Nobody is manually browsing the internet looking for your five-user app. That's not the threat. Automated scanners crawling every reachable address are, and they don't care how small you are.
Read itJanuary 11, 2026 · 5 min read
A Pre-Launch Checklist for Anything That Touches Payments
If your AI-built app charges cards, handles refunds, or applies discounts, the usual security checklist isn't enough. Here's what to check specifically before money is involved.
Read itJanuary 10, 2026 · 4 min read
The One-Page Security Checklist for Anyone Building With AI
Everything from this week in one place: headers and keys, the RLS myth, login gaps, key types, and why a second pair of eyes catches what you can't.
Read itJanuary 9, 2026 · 5 min read
What "the Database Is Open to the Internet" Actually Means
A plain-English teardown of how an exposed database actually gets found, using a made-up example that mirrors real cases from the past year.
Read itJanuary 8, 2026 · 4 min read
Your AI Coding Tool Can Review Its Own Code. That Is Not a Second Opinion.
Every major AI coding tool picked up some version of a built-in security check in 2025. Here is why that check keeps missing the exact things an outside reviewer catches instead.
Read itJanuary 7, 2026 · 5 min read
I'm Not Technical. How Do I Know If My App Is Safe?
You don't need to read code to check whether your AI-built app is safe. You need five plain questions and an ear for the difference between a specific answer and a comforting shrug.
Read itJanuary 6, 2026 · 4 min read
Vibe Coding Had Its Breakout Year. Here's What Broke Along the Way.
Vibe coding went from a Karpathy tweet to Collins Dictionary's Word of the Year in ten months. Here's what I actually watched happen: the Lovable RLS disclosure, Base44's $80 million acquisition with an open door, and the Replit database that got deleted mid-freeze.
Read itJanuary 5, 2026 · 5 min read
Public Key or Secret Key? A Two-Minute Test You Can Run From Your Own Browser
Every app has API keys sitting in its front-end code where anyone can see them. Most of the time that's completely fine. Here's how to tell, using nothing but your browser's dev tools, whether yours is one of the fine ones.
Read itJanuary 4, 2026 · 4 min read
What Cursor Secures by Default, and What It Leaves to You
I use Cursor most days for client work. Here's exactly what it checks before your code ships, and what it quietly leaves for you to catch yourself.
Read itJanuary 3, 2026 · 4 min read
I Asked an AI to Add Login. The Admin Page Never Got the Memo.
A small side project, one prompt for add login, and an admin page that stayed wide open the whole time. What checking it later taught me about verifying AI-written code instead of trusting it.
Read itJanuary 2, 2026 · 4 min read
Using Supabase or Firebase? That Doesn't Mean Your App Is Secure
Supabase and Firebase both give you the tools to lock down user data. Neither one turns the locks for you. Here's what Row Level Security and Firebase rules actually do in plain English, and what happened in 2025 when a wave of AI-generated apps shipped without them.
Read itJanuary 1, 2026 · 4 min read
Five things to check before you launch what you built over the holidays
A practical pre-launch checklist for anything you built over the break: security headers, exposed keys, database access rules, admin routes, and login checks, before real users touch it.
Read it