Security guidance for AI-built apps.

Read LyraShield AI research and practical guidance on securing AI-built apps, interpreting security evidence, verifying findings, and retesting fixes.

Follow via RSS

Browse by category

6 categories

Builder workflowsVibe-Coding SecurityPractical security habits for builders shipping apps written largely by AI coding tools.92articles
Identity & data boundariesAccess ControlAuthentication, authorization, row-level security, and sessions — keeping the wrong people away from the right data.44articles
Browser attack surfaceWeb SecurityHeaders, CORS, injection, and the rest of the browser-facing attack surface of a modern web app.40articles
Dependencies & pipelinesSupply ChainDependencies, packages, CI/CD, and third-party services — securing the code you didn't write yourself.17articles
Autonomy & guardrailsAgent SecurityPermissions, prompt injection, sandboxing, and guardrails for coding agents and agent-native applications.24articles
Evidence & retestingVerificationChecking that findings are real and fixes actually hold: evidence, retesting, and honest security claims.91articles

More practical guidance

100 articles

A focused system or change set crossing trust boundaries and a human evidence gate

Jul 17, 20266 min read

Threat Modeling for Non-Security Founders

Build a lightweight startup threat model from assets, trust boundaries, misuse cases, mitigations, owners, tests, and review triggers.

Client requests crossing origin, protected transport, and capacity gates

Jul 17, 20266 min read

TLS and Mobile Transport Security

Remove cleartext exceptions from mobile releases, test the real networking stack, and verify certificates, redirects, and backend TLS.

An identity signal passing through a gate to one scoped resource

Jul 17, 20266 min read

The Two-Account Test for Data Isolation

Use two owned accounts and synthetic records to test object-level authorization across reads, writes, deletes, exports, files, and nested resources.

A provenance chain crossing an approval checkpoint into a sealed build

Jul 17, 20266 min read

Secure a v0-Generated App

Trace a v0 app from generated code through Next.js server boundaries, Vercel previews, environment variables, and the deployed site.

A sealed build artifact moving through a controlled deployment corridor

Jul 17, 20267 min read

Secure Vercel Deployments and Preview URLs

Treat every Vercel preview as a live environment, then control deployment access, variables, data, bypass secrets, callbacks, and retirement.

A scanner beam producing an evidence receipt for one inspected subject

Jul 17, 20266 min read

How to Verify a Security Finding

Verify a vulnerability finding by checking scope, code paths, prerequisites, safe reproduction, impact, and independent evidence.

Six layered security paths joining at a translucent evidence gate

Jul 17, 202615 min read

Vibe Coding Security: The Complete Guide

A six-layer guide to testing AI-built apps, preserving evidence, retesting fixes, and making an honest release decision.

A monitoring path feeding a recovery loop around a production core

Jul 17, 20267 min read

How to schedule weekly security checks

Combine event-triggered checks with a weekly default-branch scan, named ownership, response deadlines, and recorded retests.

Untrusted instructions crossing agent and rules planes while the control path remains isolated

Jul 17, 20266 min read

Secure a Windsurf Project

Control Cascade terminal actions, MCP tools, credentials, shared rules, and branch review as Windsurf moves into Devin Desktop.

Untrusted output crossing layered browser response controls

Jul 17, 20267 min read

XSS in AI Apps That Render Markdown or Model Output

Trace untrusted Markdown and model output through parsing, sanitization, DOM insertion, CSP, and safe local verification.