Security guidance for AI-built apps.

Read LyraShield AI research and practical guidance on securing AI-built apps, interpreting security evidence, verifying findings, and retesting fixes.

Follow via RSS

Browse by category

6 categories

Builder workflowsVibe-Coding SecurityPractical security habits for builders shipping apps written largely by AI coding tools.92articles
Identity & data boundariesAccess ControlAuthentication, authorization, row-level security, and sessions — keeping the wrong people away from the right data.44articles
Browser attack surfaceWeb SecurityHeaders, CORS, injection, and the rest of the browser-facing attack surface of a modern web app.40articles
Dependencies & pipelinesSupply ChainDependencies, packages, CI/CD, and third-party services — securing the code you didn't write yourself.17articles
Autonomy & guardrailsAgent SecurityPermissions, prompt injection, sandboxing, and guardrails for coding agents and agent-native applications.24articles
Evidence & retestingVerificationChecking that findings are real and fixes actually hold: evidence, retesting, and honest security claims.91articles

More practical guidance

100 articles

A dependency lattice connected by version rings and provenance joints

Jul 17, 20267 min read

Secure React Frontends Without Trusting the Browser

Use React's rendering protections correctly while keeping authorization, secrets, sensitive data, and side effects behind verified server boundaries.

A processing core inside an isolation chamber with one filtered egress path

Jul 17, 20267 min read

Secure a Replit App Before Launch

Separate Replit Preview from production, choose the right deployment, protect secrets and APIs, and inspect live response headers.

A review plane binding a change set to a sealed artifact

Jul 17, 20266 min read

How to review an AI-generated pull request

Restate intent, split the diff by trust boundary, inspect hidden artifacts, run independent tests, and require accountable human approval.

Duplicate and scanner receipts normalized into one versioned inspection result with visible coverage limits

Jul 17, 20267 min read

SARIF for AI Coding Workflows

Structure security results as SARIF 2.1.0 with stable rules, locations, fingerprints, redaction, validation, and honest evidence limits.

Distinct testing planes, evidence, coverage, and limitations assembled into a decision or report structure

Jul 17, 20266 min read

SAST vs DAST vs SCA for AI-Built Apps

Compare the evidence, timing, targets, and blind spots of SAST, DAST, and SCA, then combine them into a practical release workflow.

Jul 17, 20266 min read

Secret Scanning Before Every Commit

Catch secrets in staged changes, enforce scanning on the remote, govern bypasses, keep fixtures inert, and rotate real exposures before cleanup.

Repository rule planes with one altered layer isolated from the agent path

Jul 17, 20267 min read

What Never to Paste Into an AI Coding Tool

Keep live credentials out of AI tools, and use customer or regulated data only through an approved, minimized workflow with verified controls.

A restricted route passing through two policy locks

Jul 17, 20267 min read

Secure Admin Routes in AI-Built Apps

Inventory privileged actions, enforce one server-side policy across every method, and test admin routes with ordinary accounts.

A scoped identity and action path crossing rate, verification, and authorization checkpoints

Jul 17, 20266 min read

Secure internal tools built by non-developers

Protect AI-built internal tools with managed identity, per-action authorization, narrow service accounts, audit logs, recovery, and a shutdown owner.

An untrusted file or diagnostic channel isolated from executable and public-response space

Jul 17, 20267 min read

Secure File Uploads in AI-Built Apps

Build a staged upload pipeline with early size limits, server-generated names, content checks, quarantine, and private delivery.