Hardening · Case study
An Exposed .git Folder Gives Away Your Whole Site. Check Yours.
What an attacker can rebuild from a public .git directory, how to test your own site in under a minute, and the web server rule that closes it.
// Security Blog
Security notes for teams shipping AI-built apps
Documented incidents and plain-English fixes for founders, freelancers and agencies building with Lovable, Bolt, Cursor and Replit. A new article every Friday.
Checklist
Before You Launch a Lovable, Bolt or Cursor App: 7 Security Checks
Seven practical security checks to run on an app built with Lovable, Bolt, Cursor or Replit before real users and real data arrive.
Supabase · Guide
Supabase Row Level Security, Explained for AI-Built Apps
What Row Level Security does, why tables made by AI tools often ship without it, and a 5-minute way to check whether your Supabase app is exposed.
Research · Incidents
Vibe Coding Risk Is Documented: What the Record Shows (2025–2026)
UpGuard, Wiz, Escape.tech and Veracode have documented the security cost of shipping AI-built apps unreviewed. Here is the record so far, with sources.