the blog
What AI leaves open.
Plain-English writing on the security holes AI coding tools leave behind, and how to close them.
April 3, 2026 · 4 min read
The Bot Token I Committed 'Just to Test It Quickly' Could Read Every Channel in the Workspace
A five-minute integration to post updates into a team channel. The token behind it turned out to be able to do a lot more than post, and it sat in a public repo for longer than I want to admit.
Read itApril 2, 2026 · 4 min read
A Posted Privacy Policy Is a Promise. It Isn't Proof You Kept It.
Plenty of apps have a privacy policy generated in minutes and never look at again. The document says what you claim to do. Nothing about posting it confirms your app actually behaves that way.
Read itApril 1, 2026 · 4 min read
If Someone Asks "What Data Do You Have on Me," Could You Actually Answer?
Deletion gets most of the attention. The quieter, equally common request is simpler and just as often unbuilt: show me everything you're holding about me, in one place.
Read itMarch 31, 2026 · 5 min read
Three Months, One Page: The Q1 2026 Recap
Everything from January through March, condensed. Features that need their own check, myths worth retiring, and the real incidents that happened while this was being written.
Read itMarch 30, 2026 · 4 min read
The Signup Form Only Asked for a Name and Email. The Request Behind It Accepted a Lot More.
A form with three visible fields doesn't mean the endpoint behind it only accepts three fields. If it saves whatever it's handed, a visitor can sometimes just add a field the form never offered.
Read itMarch 29, 2026 · 4 min read
For a Security Fix Specifically, Does It Matter Who You Hire?
The generalist who built your app can usually implement a specific fix once it's identified. Finding the fix that needs implementing is a different skill, and it's the one worth being deliberate about who has it.
Read itMarch 28, 2026 · 4 min read
What Actually Is a "Zero-Day," and Is It Something Your App Needs to Worry About?
The term gets used to sound alarming more often than it gets used precisely. Here's what it actually means, and why it's usually not the risk category worth spending your limited attention on.
Read itMarch 27, 2026 · 4 min read
One Quarter Into 2026, the Fixes Are Getting Faster. The Mistake Isn't Changing.
Every platform I've written about this year has shipped a real security improvement in the last three months. The gap they're all still chasing is the same one it was in January.
Read itMarch 26, 2026 · 4 min read
What Does Your App Actually Show When Something Breaks?
A crash is inevitable eventually. What your error page reveals when it happens, a friendly message or a full stack trace, is a choice, and most fast-built apps never actually make it on purpose.
Read itMarch 25, 2026 · 4 min read
GitHub Copilot Isn't Building You an App. That Changes What 'Security' Means For It.
Copilot writes code inside a project you already have, one suggestion at a time. That's a genuinely different risk shape than a tool that scaffolds a whole app, backend and all, from a single prompt.
Read itMarch 24, 2026 · 4 min read
The 'Download Your Report' Button Downloaded Someone Else's Report Too, If You Knew Where to Look
A PDF export feature that felt finished the moment the download worked. What it actually handed out depended entirely on one number in the URL that nobody thought to protect.
Read itMarch 23, 2026 · 4 min read
Removing Someone From Your Admin Panel Doesn't Automatically Log Them Out
Deleting or disabling a user record and invalidating their active session are two different actions. A lot of apps only do the first one, quietly assuming it covers the second.
Read itMarch 22, 2026 · 4 min read
The Old Version of Your API Is Probably Still Reachable, and Probably Less Protected
You added better auth checks to your API months ago. Did you check whether the earlier version it replaced is still sitting there, answering requests with none of those improvements?
Read itMarch 21, 2026 · 4 min read
The Security Checklist Worth Running Before Investor Due Diligence Starts
Technical due diligence increasingly includes a real look at your app's security, not just your growth numbers. Here's what's worth having answered before someone asks.
Read itMarch 20, 2026 · 5 min read
What "SQL Injection" Actually Means, Explained Without the Jargon
It's one of the oldest, most well-documented bugs in software, and it still shows up in fast-built apps today. Here's what it actually is, in plain terms, and why the fix is simpler than the name makes it sound.
Read itMarch 19, 2026 · 4 min read
Cyber Insurance Pays For the Cleanup. It Doesn't Stop the Break-In.
The two get compared as competing line items in a budget. They're not actually substitutes, and most insurers will tell you as much once you read what they actually require before they'll cover you.
Read itMarch 18, 2026 · 4 min read
What Does "Penetration Test" Actually Mean, and Do You Need One Specifically?
The term gets used loosely enough that it's worth defining plainly before you decide whether it's the thing you're actually looking for, or whether a different kind of review would serve you better right now.
Read itMarch 17, 2026 · 4 min read
28.6 Million New Secrets Leaked to Public GitHub Last Year. That's a 34% Jump.
GitGuardian published its annual report today. The headline number is bigger than last year's, and the detail about AI-assisted commits leaking secrets more often is the part actually worth sitting with.
Read itMarch 16, 2026 · 4 min read
The Password Reset Flow Deserves the Same Scrutiny as the Login Form
It's the feature that exists specifically to let someone into an account without their original password. That makes it one of the highest-value places to check for a mistake.
Read itMarch 15, 2026 · 5 min read
Claude Code Will Review Its Own Security If You Ask. It Won't Volunteer To.
There's a real, useful security-review command built in now, and a deeper enterprise capability just entered limited preview. Neither one runs unless you specifically reach for it.
Read it