the blog
What AI leaves open.
Plain-English writing on the security holes AI coding tools leave behind, and how to close them.
July 12, 2026 · 5 min read
A Year of Looking at AI-Built Apps Taught Me the Same Four Things, Over and Over
Different founders, different tools, different apps entirely. The same handful of gaps kept showing up regardless. Here's what a year of doing this by hand actually looked like, and what it kept teaching me.
Read itJuly 11, 2026 · 4 min read
Myth: "I Have a Privacy Policy, So My Data Handling Is Covered"
A privacy policy is a real, meaningful document, a promise about how you'll handle data. It's a separate thing entirely from whether your app's actual technical setup enforces that promise. Having one doesn't confirm the other.
Read itJuly 10, 2026 · 4 min read
How to Check Whether Your "Forgot Password" Flow Is Actually Safe
A password reset flow is a deliberate back door into an account, built for a real, legitimate reason. That makes it worth checking as carefully as the login form itself, not as an afterthought bolted on beside it.
Read itJuly 9, 2026 · 4 min read
A Reference Checklist for Every Third-Party Service You Connect
Every payment processor, email tool, or analytics service you connect brings its own set of settings worth checking once, on the way in, rather than trusting the defaults and moving on.
Read itJuly 8, 2026 · 5 min read
The Comment Box That Can Run Code in Someone Else's Browser
Cross-site scripting is one of the oldest vulnerabilities in web software, and it's still showing up in apps built this year. Here's a full teardown of how a plain-text comment field turns into a way to run code for other users.
Read itJuly 7, 2026 · 4 min read
Encryption at Rest vs in Transit: What Each One Actually Protects Against
"Is it encrypted" gets asked as if there's one answer. There are two separate protections here, guarding against two separate risks, and having one without the other still leaves a real gap open.
Read itJuly 6, 2026 · 4 min read
Q&A: Does a Free or Hobby-Tier App Actually Need a Security Check Too?
A question from someone building a small side project, not charging anyone, wondering if any of this actually applies to them. The honest answer depends less on money changing hands and more on what data the app actually holds.
Read itJuly 5, 2026 · 4 min read
Myth: "Nobody Would Think to Look for This, So It's Fine"
An obscure URL, an unlinked page, a setting nobody would guess. Obscurity feels like protection because it usually works against a casual, curious visitor. It was never built to work against anyone actually looking.
Read itJuly 4, 2026 · 4 min read
How to Check Whether Your Webhook Endpoint Trusts Absolutely Anyone
A webhook endpoint is built to receive a message from a specific service, like a payment processor. If it never checks that the message actually came from that service, it'll process a message from anyone who sends one.
Read itJuly 3, 2026 · 4 min read
What Vercel's Auto-Revoke Secret Scanning Actually Does for v0 Apps
v0 apps deploy through Vercel, which now automatically scans for exposed credentials and revokes them. Worth understanding exactly what that protects, since it's a genuinely strong safety net with a specific, limited scope.
Read itJuly 2, 2026 · 4 min read
The "Private" Beta That Google Had Already Found
A founder was confident his beta was invite-only because he'd never shared the link publicly. It turned out search engines don't need an invitation, and this is the story of how he found out.
Read itJuly 1, 2026 · 4 min read
Windsurf Is Retiring Cascade for Devin Local, and Agent Transitions Are Worth Watching Closely
Windsurf's Cascade agent is being phased out in favor of Cognition's Devin Local this week. Whenever a coding agent is replaced by a new one, there's a specific security question worth asking that has nothing to do with which agent is better.
Read itJune 30, 2026 · 4 min read
If Your App Has an Export or Download-All Button, Check Who Else Can Press It
A convenient bulk export feature, built for one account's own data, can sometimes be pointed at everyone else's data too, if the feature never checks whose records it's actually being asked to export.
Read itJune 29, 2026 · 4 min read
Base44 Just Shipped Its Own Model, and It's a Bigger Security Story Than It Looks
Base44 launched its own proprietary model, Base1, this week, moving from using someone else's model to owning the whole stack. That's a product story on the surface, and a meaningful security one underneath it.
Read itJune 28, 2026 · 5 min read
The Bug Where Filling Out a Normal Form Can Quietly Make You an Admin
Mass assignment is a vulnerability with a dry-sounding name and a genuinely alarming effect: a normal update request can sometimes change fields nobody meant to expose, including your own account's permission level.
Read itJune 27, 2026 · 4 min read
A One-Time Audit vs Recurring Checks: Which Does Your App Actually Need?
A single thorough check answers "is this safe today." An app that keeps shipping new features needs a different answer to a different, ongoing question. Here's how to tell which one you actually need right now.
Read itJune 26, 2026 · 4 min read
Q&A: I Have Tests and Type-Checking Set Up, Isn't That Already Security-Checked?
A question from a more technical founder who'd already set up a solid testing and type-checking pipeline. Good practices, and answering a genuinely different question than the one security testing answers.
Read itJune 25, 2026 · 4 min read
A Reference List: What a Database Access Rule Should Actually Restrict
"Turn on access rules" is common advice. Fewer people explain what a good rule actually needs to check. Here's a concrete reference for the four questions every table's rule should answer.
Read itJune 24, 2026 · 4 min read
How to Check Whether Your Admin Panel Is Actually Restricted to Admins
An admin dashboard is usually the single most powerful part of an app, and one of the easiest things to leave under-protected, because building it feels like a technical task, not a security one.
Read itJune 23, 2026 · 4 min read
What Bolt.new's Built-In Security Check Actually Looks At
Bolt.new added an automatic security-vulnerability check that runs at publish time. Worth understanding exactly what triggers it, and what publishing cleanly through it does and doesn't actually tell you.
Read it