Research · Analysis
Why AI Code Still Fails Security Tests, Even With Better Models
Veracode's 2025 and 2026 reports show models writing correct code almost every time while the security pass rate barely moves. What that means for you.
// Security Blog
Security notes for teams shipping AI-built apps
Documented incidents and plain-English fixes for founders, freelancers and agencies building with Lovable, Bolt, Cursor and Replit. A new article every Friday.
Hardening · Guide
Security Headers Every Website Should Send (10-Minute Setup)
Six HTTP response headers that close common browser-side attacks, with copy-paste nginx lines and two free tools to test your site.
Secrets · Guide
API Keys in Front-End Code: Which Are Safe and Which Are Not
Some keys are meant to be public and some never are. Learn the difference, how to check your built app, and what to do the day a secret leaks.
Access control · Guide
BOLA and IDOR Explained: When Users Can Read Each Other's Data
Broken Object Level Authorization is the top API risk on OWASP's list. Here is how it looks in a real app, how to test for it, and how to fix it.
Hardening · Case study
An Exposed .git Folder Gives Away Your Whole Site. Check Yours.
What an attacker can rebuild from a public .git directory, how to test your own site in under a minute, and the web server rule that closes it.
Checklist
Before You Launch a Lovable, Bolt or Cursor App: 7 Security Checks
Seven practical security checks to run on an app built with Lovable, Bolt, Cursor or Replit before real users and real data arrive.
Supabase · Guide
Supabase Row Level Security, Explained for AI-Built Apps
What Row Level Security does, why tables made by AI tools often ship without it, and a 5-minute way to check whether your Supabase app is exposed.
Research · Incidents
Vibe Coding Risk Is Documented: What the Record Shows (2025–2026)
UpGuard, Wiz, Escape.tech and Veracode have documented the security cost of shipping AI-built apps unreviewed. Here is the record so far, with sources.