the blog
What AI leaves open.
Plain-English writing on the security holes AI coding tools leave behind, and how to close them.
June 22, 2026 · 4 min read
The Feature That Worked Fine for Three Weeks, Until Someone Found the API Directly
An app can look completely fine through its own interface and still be wide open underneath, because the interface was never the only way in. This is a story about the gap between those two things.
Read itJune 21, 2026 · 4 min read
Myth: "I Used a Reputable AI Coding Tool, So It Already Checked for This"
Which tool built your app is a genuinely reasonable thing to care about. It's a different question from whether your specific app, with its specific data model and features, has actually been checked. The two get conflated constantly.
Read itJune 20, 2026 · 4 min read
How to Check Whether Your Login Form Can Just Be Guessed at Repeatedly
A login form with no limit on how many times it can be tried isn't a login form, it's a lock someone can keep testing keys against for as long as they want. Here's how to check yours.
Read itJune 19, 2026 · 4 min read
The 10-Minute Check Before You Send Your App to Its First Real User
A short, concrete reference list for the moment right before an app stops being a private project and starts being something a stranger will actually use. Not exhaustive, but a genuinely useful floor.
Read itJune 18, 2026 · 5 min read
The Vulnerability That's Just Changing a Number in a URL
Insecure Direct Object Reference sounds technical. It's usually just changing 482 to 483 in an address bar and seeing whether the app stops you. Here's a full teardown of why it happens and how to test for it.
Read itJune 17, 2026 · 5 min read
Manual Security Review vs an Automated Scanner: What Each One Actually Catches
These two approaches aren't competing for the same job. One is fast and consistent, the other is slower and can reason about context a pattern-matcher can't. Most apps genuinely benefit from both.
Read itJune 16, 2026 · 4 min read
Q&A: Do I Need a Security Check Before Every Feature, or Just Before Launch?
A question I get from builders shipping quickly: does every new feature need its own security pass, or is one check right before real users show up enough? The honest answer depends on what the feature actually touches.
Read itJune 15, 2026 · 4 min read
OpenAI's Security Scanner Just Followed Developers to GitLab, and That's the Interesting Part
Codex Security added a GitLab integration this month, on top of its existing GitHub support. The detail worth noticing isn't the feature itself, it's what it says about where these checks are expected to live going forward.
Read itJune 14, 2026 · 4 min read
How to Check Whether Your App Is Handing Out Its Own Blueprints in Error Messages
A detailed error message is a debugging convenience for you and a free map for anyone else. Here's a quick way to check what your app actually shows when something breaks.
Read itJune 13, 2026 · 5 min read
What Replit's Built-In Security Tools Actually Cover, and What They Don't
Replit has added its own security tooling over the past year: a dedicated Security Agent, a bulk remediation center, and a package firewall. Worth knowing exactly what each one catches before treating any of them as the whole job.
Read itJune 12, 2026 · 4 min read
The App That Looked Too Professional to Have a Problem
A founder once told me his app didn't need a security pass because it looked too polished to have anything wrong with it. Visual polish and security have almost nothing to do with each other, and this is the story of finding that out the hard way.
Read itJune 11, 2026 · 4 min read
Myth: "My App Has a Login Screen, So It's Secure"
A login screen answers one question: who are you. It says nothing about whether you, once logged in, can only see and touch what's actually yours. Those are two different problems.
Read itJune 10, 2026 · 4 min read
If Your App Lets People Upload Files, Here's What to Check in the Next 15 Minutes
A file upload feature is one of the most common places I find a gap between what a form appears to check and what the server actually enforces. Here's how to test your own.
Read itJune 9, 2026 · 4 min read
If Your App Touches Health Information, the Usual Checklist Isn't Quite Enough
Building something in or near healthcare, even a wellness tracker or a scheduling tool, changes what counts as sensitive and how carefully it needs to be handled. Here's what deserves extra attention.
Read itJune 8, 2026 · 5 min read
If Your App Fetches a URL Someone Gives It, It Might Be Reachable From the Inside
A link-preview feature, a webhook tester, anything that fetches a URL a user provides can sometimes be tricked into making requests to internal systems that were never meant to be reachable from outside at all.
Read itJune 7, 2026 · 4 min read
A Dedicated Secret Manager vs Just Using .env Files Everywhere
Environment variables are a real, meaningful improvement over hardcoding a key. A dedicated secret manager solves a further set of problems that .env files, on their own, still leave open.
Read itJune 6, 2026 · 4 min read
Does Your Terms of Service Need a Security Disclaimer, and What Does That Actually Protect?
Plenty of templates include a line disclaiming responsibility for security incidents. Worth understanding what that language actually does and doesn't shield you from before treating it as a substitute for the real work.
Read itJune 5, 2026 · 4 min read
Cursor Just Shipped a Dedicated Security Review Command. Here's Where That Puts It on the Spectrum I've Been Tracking All Year.
Cursor 3.7 landed today with a /review command aimed specifically at security. I've spent this whole year sorting tools into automatic-checks versus opt-in-checks. This one lands, clearly, in the second group.
Read itJune 4, 2026 · 4 min read
Can Your File-Download Feature Be Tricked Into Handing Over a File You Never Meant to Serve?
A download endpoint that takes a filename and reads it directly off disk can sometimes be pointed at a completely different file on the server, just by changing the filename in a specific way.
Read itJune 3, 2026 · 5 min read
A Mid-Year Look at Which AI Coding Tools Actually Check Anything by Default
I've written a separate deep dive on most of the major platforms this year. Worth stepping back and comparing them side by side on one specific question: does the tool check anything without you asking.
Read it