Security guidance for AI-built apps.

Read LyraShield AI research and practical guidance on securing AI-built apps, interpreting security evidence, verifying findings, and retesting fixes.

Follow via RSS

Browse by category

6 categories

Builder workflowsVibe-Coding SecurityPractical security habits for builders shipping apps written largely by AI coding tools.92articles
Identity & data boundariesAccess ControlAuthentication, authorization, row-level security, and sessions — keeping the wrong people away from the right data.44articles
Browser attack surfaceWeb SecurityHeaders, CORS, injection, and the rest of the browser-facing attack surface of a modern web app.40articles
Dependencies & pipelinesSupply ChainDependencies, packages, CI/CD, and third-party services — securing the code you didn't write yourself.17articles
Autonomy & guardrailsAgent SecurityPermissions, prompt injection, sandboxing, and guardrails for coding agents and agent-native applications.24articles
Evidence & retestingVerificationChecking that findings are real and fixes actually hold: evidence, retesting, and honest security claims.91articles

More practical guidance

100 articles

An incident signal contained before entering a retest path

Jul 17, 20266 min read

How to rotate and recover from an exposed API key

Respond to an exposed API key: contain access, rotate safely, verify rejection, investigate misuse, clean reachable copies, and document recovery.

A server request or path corridor crossing input, authorization, and destination-boundary rechecks

Jul 17, 20266 min read

Secure FastAPI Code Generated by AI

Separate Pydantic request validation from object authorization, then configure CORS, hosts, proxy trust, TLS, errors, and API documentation.

A restricted route passing through two policy locks

Jul 17, 20266 min read

Secure Firebase Rules and Storage

Design Firebase security as separate identity, authorization, app-attestation, and abuse-resistance layers, then test Firestore and Storage rules locally.

A provenance chain crossing an approval checkpoint into a sealed build

Jul 17, 20266 min read

Secure GitHub Actions Used by Coding Agents

Harden coding-agent workflows with untrusted-input separation, minimal token permissions, pinned actions, constrained OIDC, and approval gates.

Jul 17, 20266 min read

Hallucinated Packages and Slopsquatting

Check generated package names against official registries, repositories, releases, and owners before any installation runs.

A focused system or change set crossing trust boundaries and a human evidence gate

Jul 17, 20267 min read

Human Review and Threat Modeling for Vibe Coding

Run a lightweight threat-model review for an AI-built app by mapping real data flows, assigning owners, and turning decisions into testable release checks.