Security for apps built with AI
The new vulnerabilities that hit your stack, and how to fix them with your agent.
CVE-2026-109618: Check Your PHP Version Today
Two critical PHP RCE flaws (CVE-2026-109618, CVE-2026-109619) were patched October 21. How to check your PHP version and update before attacks start.
Read the article →Is Cursor Safe? What to Check Before You Ship
Is Cursor safe? The app is: SOC 2 Type II, ISO 27001, and no training on your code by default. The real risk is the code it writes. Here's what to check.
Security Headers: How to Check and Fix Them
Learn which security headers matter, how to check yours in two minutes, and the exact config to paste into Next.js, Vercel, or Netlify.
Vibe Coding Security Checklist: 12 Checks Before You Ship
12 security checks for a vibe-coded app, in the order they leak on launch day, with copy-paste prompts for your AI coding agent.
Vibe Coding Security Risks: What Your AI Assistant Gets Wrong
Vibe coding ships fast, but AI assistants get security wrong more often than you'd expect. The real risks, the numbers, and prompts to fix them.
Is Lovable Secure? What to Fix Before You Launch
Lovable is secure; your app is only as safe as its Supabase config. The real risks of Lovable apps and the checks to run before launch.
Supabase Service Role Key: Where It Must Never Appear
The Supabase service role key bypasses Row Level Security and grants full database access. Where it must never appear, and how to fix a leak.
Supabase anon vs service_role key: which one can you expose?
The anon key can stay in your frontend because it only opens what Row Level Security allows. The service_role key bypasses RLS and must never leave your server. Here is how to tell them apart and where to check for leaks.
Supabase Security Checklist: 10 Checks Before You Launch
10 checks to secure your Supabase app before launch: RLS, service_role keys, auth, storage, realtime, and Vault — with copy-paste fixes.
Supabase RLS: securing your AI-coded app
Row Level Security is the PostgreSQL mechanism that filters table rows per user. Here is how to enable it, write your policies and close the access your coding agent left open on Supabase.
Supabase Anon Key: Is It Safe to Expose in the Browser?
Yes, the Supabase anon key is safe to expose — but only with Row Level Security on. Here's what it does, what it can't do, and how to check yours.