Blog
Incidents
Public incidents with their primary sources, and what to check in your own app.
13 Aug 2026
Replit's agent deleted a production database: what changed since
What the founder and Replit's CEO said in July 2025, what Replit's docs now describe for dev and production databases, and the two checks that matter.
2 Jul 2026
Base44's auth bypass: what a platform fix teaches app owners
Wiz found a login bypass in Base44 and Wix fixed it within a day. Why your own permission rules still decide what a logged-in stranger can reach.
18 Jun 2026
Moltbook's exposed Supabase database: what to check in yours
Wiz found tokens and emails readable in Moltbook's Supabase tables without RLS. What Supabase's docs say about the defaults, and how to check your project.
4 Jun 2026
Lovable's RLS CVE: what it means for your app
What the Lovable RLS scan found, what Lovable disputes, what its docs say about database rules and scans, and three checks you can run today.
Tool changes
Builders change defaults monthly. What changed, with the doc it comes from.
19 Sep 2026
Clerk's new lockout default and where route protection belongs
Clerk lowered its account lockout threshold and deprecated createRouteMatcher. What the docs say, why checks belong next to the data, and what to test.
15 Sep 2026
Next.js middleware becomes proxy: what it means for your auth checks
Next.js renamed middleware to proxy and says not to rely on it for authorization. What the docs state about Server Actions and page-level checks, and two tests.
8 Sep 2026
Lovable's defaults in 2026: TanStack Start, Cloud and the security scans
What Lovable's docs say in 2026 about the TanStack Start default, Cloud backend, publish visibility and the Basic and Deep scans, and what a tester looks at.
27 Aug 2026
Supabase's publishable and secret keys: what changes for your app
Supabase is replacing anon and service_role keys with sb_publishable_ and sb_secret_ by end of 2026. What the docs say and what to search your bundle for.
Patterns
One failure pattern at a time, for a non-engineer, with the self-check.
21 Jul 2026
Prompt injection in apps with AI features: a plain-English guide
What prompt injection is, why it matters once a model can call tools or write to your database, two Cursor CVEs as an example, and three checks to run.
7 Jul 2026
Stripe webhook signature: the one-minute test
How to confirm your Stripe webhook rejects unsigned events, what a correct handler returns, and why replayed events need an idempotency check as well.
23 Jun 2026
An RLS policy of using (true): why the RLS check passes and the data still leaks
RLS is on, the error-level lint is quiet, and yet every row is readable. How a permissive policy hides, the two-account test that shows it, and the fix.
9 Jun 2026
Finding a service-role key in your browser bundle
A non-engineer's walkthrough: search the JavaScript your app ships for Supabase and Stripe secret keys, understand why it matters, and what to do next.
Methods
How we test, how to read statistics, and what a report should contain.
15 Sep 2026
What a security summary for investors should contain
The six parts of a security summary a diligence reviewer can use: scope, method, findings by severity, verified fixes, open items, date. And what it is not.
1 Sep 2026
Two test accounts: the cheapest security test you can run
Create two users, try to read and change each other's records, open the admin URL, and call a paid endpoint from the free account. Half an hour, no code.
18 Aug 2026
Reading AI code security statistics before you repeat them
What the Veracode, CodeRabbit, Tenzai and Escape studies measured, what their sample sizes mean, and why one widely reposted percentage is not on this site.
4 Aug 2026
How we test an AI-built app in 48 hours
The pre-launch check from the inside: the access we need, the order we test in, how the report is written for a non-engineer, and what it does not cover.