Keep AI Agents Away From Production Deletes
Block standing production delete authority with separate identities, permission ceilings, exact approvals, short-lived access, and audit records.
Identity & data boundaries
Access Control
Authentication, authorization, row-level security, and sessions — keeping the wrong people away from the right data.
44published articles
AI App Pre-Launch Security Checklist
Run an evidence-based pre-launch review across authorization, secrets, inputs, dependencies, deployment, agents, monitoring, recovery, and retests.
Why AI-Generated Tests Are Not Security Proof
Use AI-generated tests as regression checks, then add independent invariants, negative cases, mutation checks, and scoped retest evidence.
Secure an AI SaaS With Stripe
Secure Stripe billing with server-owned entitlements, raw-body webhook verification, idempotent processing, constrained keys, and failure-path tests.
Stop Exposing API Keys in Frontend Code
Identify secrets shipped in browser bundles, move privileged calls behind a server boundary, and rotate exposed credentials safely.
Secure a Base44 App Before Launch
Separate Base44 app visibility from data permissions, review table access and backend secrets, then verify the deployed app with distinct accounts.
Secure a Bolt App Before Launch
Identify the Bolt backend, protect server functions and webhooks, test database policy, and verify the published deployment.
Stop Brute Force and Account Enumeration
Make authentication responses uniform, throttle online guessing by account and network signals, and test recovery flows safely.
Prevent CI/CD Agents From Becoming a Confused Deputy
Keep untrusted pull requests outside privileged CI jobs with narrow tokens, protected deployments, bound OIDC claims, and verified artifacts.
Why Client-Side Auth Is Not Access Control
Understand why route guards and hidden controls cannot enforce access, then place authorization at the server operation that needs it.
Secure Cloudflare Workers Built With AI
Treat Worker bindings as capabilities, keep secrets encrypted, constrain outbound fetch and caching, and verify routes with production-shaped Wrangler config.
Secure FastAPI Code Generated by AI
Separate Pydantic request validation from object authorization, then configure CORS, hosts, proxy trust, TLS, errors, and API documentation.
Secure Firebase Rules and Storage
Design Firebase security as separate identity, authorization, app-attestation, and abuse-resistance layers, then test Firestore and Storage rules locally.
Human Review and Threat Modeling for Vibe Coding
Run a lightweight threat-model review for an AI-built app by mapping real data flows, assigning owners, and turning decisions into testable release checks.
How to Find IDOR in an AI-Built App
Use a safe two-account test to find object authorization flaws, then fix the resource lookup instead of hiding identifiers.
JWT Validation Mistakes AI Tools Generate
Validate JWT signatures, algorithms, issuers, audiences, time claims, and token types with a deployment-specific trust policy.
Design Least-Privilege MCP Tools
Narrow MCP tools by verb, resource, schema, token audience, and approval so model-controlled calls cannot inherit broad authority.
Secure a Lovable App Before Launch
Review a Lovable app across its public frontend, Edge Functions, database RLS, authentication, scans, and publish settings.
Prevent Mass Assignment in CRUD APIs
Stop request bodies from changing roles, owners, prices, and workflow state with operation-specific schemas and explicit data writes.
Stop Prompt Injection From Spreading Across Agents
Contain multi-agent prompt injection with preserved provenance, structured handoffs, separated capabilities, intent checks, and safe canary tests.
Prevent Cross-Tenant Data Leaks
Carry a server-owned tenant context through APIs, jobs, caches, storage, and database queries, then verify it with two tenants.
Secure a Next.js App Generated by AI
Treat every callable Next.js server entry as an API, centralize authorization in a server-only data layer, and minimize data sent to the browser.
Secure Node and Express APIs Generated by AI
Build an ordered Express request contract, authorize resources at every route, and verify proxy, session, limit, error, and dependency settings.
Secure OAuth Redirects and Callbacks
Secure OAuth redirects with exact registration, transaction-bound callback state, PKCE, issuer checks, and a strict code exchange.
Password Hashing for Vibe Coders
Store passwords with maintained memory-hard hashing, deployment-tested work factors, safe migration, and rehashing on login.
Secure Password Reset and Email Verification
Design reset and verification flows with uniform responses, single-use tokens, trusted links, and explicit session decisions.
Keep Pricing and Entitlements Off the Client
Authorize paid features from server-owned entitlement state, reconcile provider updates, and handle stale access without trusting client claims.
Public-by-Default Deployments and Storage
Find exposed previews, app origins, database APIs, and storage before launch, then prove each access boundary with logged-out and second-account tests.
Secure React Frontends Without Trusting the Browser
Use React's rendering protections correctly while keeping authorization, secrets, sensitive data, and side effects behind verified server boundaries.
Secure a Replit App Before Launch
Separate Replit Preview from production, choose the right deployment, protect secrets and APIs, and inspect live response headers.
Secure Admin Routes in AI-Built Apps
Inventory privileged actions, enforce one server-side policy across every method, and test admin routes with ordinary accounts.
Secure internal tools built by non-developers
Protect AI-built internal tools with managed identity, per-action authorization, narrow service accounts, audit logs, recovery, and a shutdown owner.
Build a Secure MCP Server
Secure an MCP server with deliberate transport choices, audience-bound tokens, per-tool authorization, session isolation, and execution-time approval.
Secure public AI API endpoints
Protect public AI APIs with object authorization, bounded work, cost controls, constrained tools, safe output handling, and tested failure paths.
Secure Session Cookies
Configure host-scoped session cookies, choose SameSite deliberately, rotate identifiers, and test server-side expiry and revocation.
Audit Logs for Security-Sensitive Actions
Design scoped audit events that reconstruct sensitive actions, resist silent changes, protect private data, and survive collection failures.
Build a Go / No-Go Security Launch Gate
Turn scoped security evidence into an accountable go, conditional, no-go, or not-evaluated decision with owners and rollback readiness.
Server-Side Authorization for AI-Generated APIs
Create one deny-by-default authorization seam for API actions, resources, and tenants, then test every sensitive path.
Supabase RLS for Vibe-Coded Apps
Build and test Supabase row-level security with precise grants, command policies, and two-account checks before release.
Secure Supabase Auth, RLS, and Service Keys
Secure the Supabase access chain from API grants and row-level security through user JWTs, server-only privileged keys, views, and functions.
Threat Modeling for Non-Security Founders
Build a lightweight startup threat model from assets, trust boundaries, misuse cases, mitigations, owners, tests, and review triggers.
The Two-Account Test for Data Isolation
Use two owned accounts and synthetic records to test object-level authorization across reads, writes, deletes, exports, files, and nested resources.
Secure Vercel Deployments and Preview URLs
Treat every Vercel preview as a live environment, then control deployment access, variables, data, bypass secrets, callbacks, and retirement.
Vibe Coding Security: The Complete Guide
A six-layer guide to testing AI-built apps, preserving evidence, retesting fixes, and making an honest release decision.