Security Blog
Practical advice for founders and developers building with AI coding tools. No jargon, no filler — just what you need to ship securely.
Your API key is in your source code, your git history, or your page source. Here is the exact step-by-step process to contain the damage and secure your app before more harm is done.
Read article →A deep dive into the security posture of 50 real apps built with Lovable, Bolt, Cursor, and Replit. 89% had at least one critical issue.
Read article →The OWASP Top 10 is the industry's list of the most dangerous web security vulnerabilities. Here's what each one means for your AI-built app — explained without jargon.
Read article →Bolt.new ships working apps in minutes. But wildcard CORS, exposed API keys, and missing validation are baked into the defaults. Here's how to fix every major Bolt security issue.
Read article →Row Level Security is the most important security feature in Supabase. Here's why AI-built apps skip it, what happens when they do, and how to fix it in 10 minutes.
Read article →Lovable makes it easy to ship a full-stack app. It also ships with predictable security gaps. Here's what's exposed in most Lovable apps and how to fix it.
Read article →Twenty-five security checks to complete before your AI-built SaaS goes live. Covers authentication, secrets, headers, database access, and payment security.
Read article →You built your app with Lovable, Bolt, or Cursor. Now you need to know what's exposed — and what to do about it. This guide explains it without the jargon.
Read article →