Security research, breach analysis, and engineering deep-dives.
AI generates CRUD endpoints that work perfectly — but don't check if the requesting user actually owns the resource. Here's how IDOR vulnerabilities slip into AI-generated code, how attackers exploit them, and how to fix every one.
Read article
How an AI agent social network built with vibe coding left its entire Supabase database wide open. A deep technical breakdown of the breach, what went wrong, and what every builder can learn from it.
The OWASP Top 10 isn't just for security teams. Your AI coding tool just generated code that touches most of these categories. Here's what each one looks like in a vibe-coded app.
SQL injection was discovered in 1998 and should be a solved problem. But AI coding tools are bringing it back — generating string concatenation, raw queries, and dynamic column names that open the door to attacks. Here's how to spot it and fix it.
AI coding tools make shipping fast, but they also make leaking secrets easy. Here's how environment variables end up in your client-side bundle, how to audit your app in five minutes, and how to fix it before someone else finds your keys.
A step-by-step security guide for apps built with Lovable. Fix the most common vulnerabilities in under an hour — no security expertise required.
CVE-2025-48757 exposed a systematic Row Level Security failure in Lovable, one of the most popular vibe coding platforms. 170+ apps. 303 vulnerable endpoints. A 1.8/10 security score. Here's what happened, why it matters, and what every builder should do about it.
A realistic walkthrough of how an attacker finds, probes, and exploits a typical app built with AI coding tools. From Google dorking to data exfiltration, here's exactly what happens — and what you can do about each step.
Traditional scanners match patterns. LLM-powered scanners read your app like a human would. Here's a side-by-side comparison of what each one finds — and misses — on the same endpoint.
You built an app in a weekend. Flowpatrol is the five-minute scan that tells you if it's ready for the real world. Here's what it finds and how it works.
Row Level Security is the difference between a secure Supabase app and a public database. Here's how RLS works, why AI tools skip it, and how to set it up in 15 minutes.
A ranked list of the most common security issues we find in apps built with AI coding tools, with real examples and concrete fixes for each one.