the blog
What AI leaves open.
Plain-English writing on the security holes AI coding tools leave behind, and how to close them.
May 13, 2026 · 4 min read
The Referral Bonus Program Worked Perfectly. It Just Also Worked Perfectly for One Person Referring Themselves 40 Times.
A generous referral bonus, built fast, with no check on whether the referrer and the new signup were suspiciously connected. Someone noticed before we did, and used it as intended, just far more than intended.
Read itMay 12, 2026 · 4 min read
Two-Factor Authentication Protects the Login. It Has Nothing to Do With What Happens After.
Adding 2FA feels like the security upgrade that covers everything. It closes off one real, specific risk and leaves every access-control question on this blog exactly as open as before.
Read itMay 11, 2026 · 4 min read
OpenAI Just Named Its Cybersecurity Push "Daybreak." Here's What's Actually In It So Far.
A named initiative built around Codex Security, launched today. The branding is new. The underlying question, whether tools this capable actually reach the builders who need them most, isn't.
Read itMay 10, 2026 · 4 min read
The Checklist Specific to Anything That Sells Physical Products Online
Beyond the general payment checklist, a real online store has its own extra failure modes: inventory races, coupon stacking, and shipping details that reveal more than a customer's own order.
Read itMay 9, 2026 · 5 min read
What a Missing Content Security Policy Actually Fails to Stop
A CSP header sounds like an obscure technical detail. What it actually does is decide whether a single unescaped input field can turn into a script running with full access to your page.
Read itMay 8, 2026 · 4 min read
An Ongoing Security Relationship Catches Different Things Than a One-Off Engagement Ever Will
It's not just about frequency. Someone who knows your app's history and your specific decisions catches things a fresh, one-time reviewer structurally can't, no matter how good they are.
Read itMay 7, 2026 · 4 min read
"Data Breach" and "Data Exposure" Aren't Interchangeable, and the Difference Matters to Customers
One implies someone actively broke in. The other means something was reachable that shouldn't have been, whether or not anyone's confirmed to have taken it. Using the wrong word changes how the conversation goes.
Read itMay 6, 2026 · 4 min read
A New Report Claims 380,000 Vibe-Coded Apps Are Publicly Exposed. Here's How I'm Reading It.
Coverage circulating this week cites a large new number across Lovable, Base44, Netlify, and Replit. The topline figure is worth taking seriously in direction. I'd hold off repeating the exact numbers as gospel just yet.
Read itMay 5, 2026 · 4 min read
Does Your Login Form Respond Faster for Accounts That Don't Exist?
A subtle timing difference between "this account exists" and "this account doesn't" can leak information even when the actual error message looks identical either way.
Read itMay 4, 2026 · 4 min read
The Attack on Amazon Q Developer Wasn't Aimed at Anyone's App. It Was Aimed at the Tool Itself.
Last summer, malicious code got merged into Amazon's own coding assistant extension through prompt injection. It's a different category of risk than everything else on this blog, and worth understanding on its own terms.
Read itMay 3, 2026 · 4 min read
I Gave a New Support Contractor Access to 'The Customer Database.' That Meant All of It.
Onboarding someone to help with support tickets felt like a small, routine task. The access I handed over to make that possible was much bigger than the job actually needed.
Read itMay 2, 2026 · 4 min read
"It's in an Environment Variable" Doesn't Automatically Mean It's Safe
Moving a key out of your code and into an environment variable is real progress. It's also not the finish line, and there are several ordinary ways an env variable still ends up somewhere it shouldn't.
Read itMay 1, 2026 · 4 min read
Your 'New Signup' Slack Alert Might Be Broadcasting More Than You Realize
Internal notifications feel low-stakes because they're internal. The moment one includes real customer details and lands somewhere more people can see than intended, that stops being true.
Read itApril 30, 2026 · 4 min read
April's Checklist, All in One Place
Background jobs, script tags, JWTs, and the two real Lovable incidents that happened in the same week but weren't the same bug. April, compressed onto one page.
Read itApril 29, 2026 · 5 min read
What a Broken JWT Actually Lets Someone Forge
A JWT looks like a secure, tamper-proof login token. Whether it actually is depends entirely on whether your server verifies its signature properly, and that's a step that's surprisingly easy to get quietly wrong.
Read itApril 28, 2026 · 4 min read
Should You Ever Launch With a Known, Small Security Gap Still Open?
Waiting for a perfectly clean bill of health before shipping anything sounds responsible. In practice, the right answer depends entirely on what the specific gap actually is, not on treating every finding the same.
Read itApril 27, 2026 · 4 min read
What Happens to Your Data If the Platform You Built On Shuts Down Tomorrow?
Not a comfortable question, and one worth an honest answer before you need it, given how much churn this exact category of tool has already seen in barely two years.
Read itApril 26, 2026 · 4 min read
The Question I Wish More Builders Led With, and Rarely Do
Almost everyone asks whether their app works. Almost nobody asks the second question that actually matters just as much, and it's a genuinely easy one to start asking.
Read itApril 25, 2026 · 4 min read
Does Your Search Bar Respect the Same Access Rules as Everything Else?
A search feature is easy to build as a shortcut around your normal access checks, because searching everything and filtering afterward feels simpler than filtering first. That shortcut is exactly where it leaks.
Read itApril 24, 2026 · 4 min read
Your Zapier or Make Automation Has an AI Step Now. Check What It Can Actually Touch.
Adding an AI action to an existing automation is a single click. What that AI step gets to read and write across every connected app in the chain is worth actually checking before you enable it.
Read it