the blog
What AI leaves open.
Plain-English writing on the security holes AI coding tools leave behind, and how to close them.
March 14, 2026 · 4 min read
The QR Code on the Wall Pointed Straight at an API Nobody Meant to Make Public
A simple check-in kiosk for a small event. The QR code that made it convenient also made the underlying API trivially easy for anyone to find and call directly.
Read itMarch 13, 2026 · 4 min read
"It's Just an Internal Tool, It Doesn't Need Real Login" Is How Internal Tools Become Public Ones
An internal dashboard built without real authentication is only internal because nobody outside the team has found the URL yet. That's not a security boundary. It's a coincidence with an expiration date.
Read itMarch 12, 2026 · 4 min read
The Checklist Worth Running Before You Wire In Any New Third-Party Service
Every integration you add, a payment processor, an email tool, an analytics widget, inherits a piece of your app's trust. Most get wired in without anyone asking what that piece actually includes.
Read itMarch 11, 2026 · 5 min read
Your Admin Panel Deserves Its Own Checklist, Not Just a Login Screen
It's the single most powerful part of your app, and it's usually the part built last, fastest, and checked least. Here's what actually deserves attention once it exists.
Read itMarch 10, 2026 · 4 min read
What a Missing Rate Limit Actually Costs, In Real Numbers
"You should add rate limiting" sounds like advice with no urgency behind it. Here's a walkthrough of what an unlimited endpoint actually allows, in scripts-per-minute terms, not abstract warnings.
Read itMarch 9, 2026 · 4 min read
When a Security Fix Is a Quick AI-Assisted Afternoon, and When It Isn't
Some fixes really are a five-minute setting change. Others just look that simple, and fixing them wrong is worse than not touching them at all. Here's how to tell which one you're looking at.
Read itMarch 8, 2026 · 4 min read
A Bug Bounty and a Hired Auditor Are Not the Same Kind of Security Spend
One pays for whatever gets found, whenever someone happens to look. The other pays for a guaranteed, scoped block of someone's attention, right now. Small apps usually need the second one first.
Read itMarch 7, 2026 · 4 min read
OpenAI Just Launched an Agent Whose Whole Job Is Threat-Modeling Your Codebase
Codex Security entered research preview yesterday. It doesn't just scan for known bad patterns, it builds a model of what your specific app is supposed to protect, and reasons about what could go wrong.
Read itMarch 6, 2026 · 4 min read
Would You Actually Notice If Something Went Wrong Right Now?
Most small apps have no monitoring at all, which means the first sign of a real problem is usually a user complaining, or a researcher's public writeup. Here's a free, twenty-minute setup that changes that.
Read itMarch 5, 2026 · 5 min read
Base44's Worst Bug Fixed in a Day. Getting Acquired Didn't Prevent It From Happening.
Six months after launch, Base44 had 250,000 users, an $80 million acquisition, and a bug that let anyone log into any private app using nothing but a public ID. Scale and funding didn't stop the mistake. Fast response limited the damage.
Read itMarch 4, 2026 · 4 min read
The Access I Gave a Summer Intern 'Just for the Project' Was Still Live a Year Later
It felt like a small, temporary favor at the time. Nobody, including me, ever circled back to close it, and that's exactly the kind of gap that doesn't announce itself.
Read itMarch 3, 2026 · 4 min read
"I Use Google Sign-In, So I Don't Have to Worry About Auth Security" Isn't Quite Right
Letting Google or another provider handle passwords genuinely removes one real risk. It doesn't touch everything that happens in your own app after that login succeeds.
Read itMarch 2, 2026 · 5 min read
If Your App Serves Multiple Companies, One Row-Level Check Isn't Enough
A multi-tenant app has an extra layer most single-user checklists miss entirely: making sure one company's data never leaks into another's, not just one user's data from another user's.
Read itMarch 1, 2026 · 4 min read
February's Checklist, All in One Place
File uploads, webhooks, session cookies, AI chat features, and the questions worth asking before you buy a certification or a subscription. A recap of the month, meant to be bookmarked.
Read itFebruary 28, 2026 · 5 min read
16 Vulnerabilities, 18,000 Student Records, and a Support Ticket That Got Closed Without a Fix
Yesterday a researcher's disclosure went public: an exam and grading app used by UC Berkeley, UC Davis, and K-12 schools had 16 vulnerabilities, six of them critical. He'd reported it already. The ticket got closed.
Read itFebruary 27, 2026 · 4 min read
A Monitoring Subscription and a One-Time Audit Solve Different Problems
One tells you if something changed. The other tells you whether what you have right now is actually sound. Neither one is a smaller version of the other.
Read itFebruary 26, 2026 · 4 min read
Does a Two-Person Startup Actually Need SOC 2?
Short answer: probably not yet. Slightly longer answer: the underlying practices behind that certification are worth adopting long before the certificate itself makes any sense to pursue.
Read itFebruary 25, 2026 · 4 min read
Cursor's New Autofix Doesn't Just Flag a Problem. It Spins Up an Agent to Go Fix It.
This month Cursor shipped a feature that lets its Bugbot spawn its own cloud agents to test and patch security issues it finds. That's a genuinely new shape of tool, and it raises a question none of the older scanners had to answer.
Read itFebruary 24, 2026 · 4 min read
Three Cookie Settings That Decide Whether Your Login Actually Holds Up
HttpOnly, Secure, and SameSite sound like configuration trivia. Get them wrong and a stray script or a malicious link can act as your logged-in user without ever touching a password.
Read itFebruary 23, 2026 · 5 min read
Windsurf's Security Story Got Complicated by Something That Had Nothing to Do With Code
A real vulnerability in its agent last year was the smaller story. The bigger one is that the company itself went through a genuinely unusual ownership shake-up, and that has its own quiet implications for anyone building on it long-term.
Read it