Security checks
Every vulnerability class, explained for people who ship with AI
One page per issue: what it is, how it shows up in generated code, how to test your own app and how to fix it.
20 pages
Security check
SQL injection in AI-generated apps: what it looks like and how to fix it
Where SQL injection hides in code written by AI tools, including string-built queries and filter strings, and the parameterised patterns that remove it.
Security check
Cross-site scripting (XSS) in React and Next.js apps
How XSS still reaches React apps through raw HTML rendering, unsafe links and stored content, plus the fixes that work.
Security check
CSRF: when your app needs protection and when it does not
Cross-site request forgery explained for apps that use cookie sessions, with SameSite settings, origin checks and tokens.
Security check
CORS misconfiguration: the settings that expose your API
What CORS does and does not protect, the risky patterns AI tools generate, and a correct allow-list configuration.
Security check
JWT security: the mistakes that let attackers forge sessions
Common JSON Web Token errors in generated auth code, such as decoding without verifying, weak secrets and missing expiry, with fixes.
Security check
Broken access control and IDOR: making sure users only see their own data
How insecure direct object references appear in generated APIs and how to test and fix them with ownership checks on the server.
Security check
Rate limiting: protecting login, OTP and paid API routes
Where rate limits matter most in AI-built apps, how to choose limits, and how to add them at the edge or in code.
Security check
Cookie security flags: HttpOnly, Secure, SameSite and the __Host- prefix
What each cookie attribute protects against and the exact Set-Cookie settings to use for session cookies.
Security check
Content-Security-Policy: a practical rollout for AI-built apps
How to write, test and enforce a Content-Security-Policy without breaking analytics, fonts or payment widgets.
Security check
Open storage buckets: how uploaded files leak and how to lock them
Why public buckets expose user files, how to check the buckets you own on common providers, and the policies that keep uploads private.
Security check
Exposed source maps: what production builds reveal
How public source maps expose your original code and comments, and how to stop shipping them or restrict them to your error tracker.
Security check
Exposed debug and admin endpoints left in production
Debug routes, test pages and admin panels that AI tools scaffold and developers forget, and how to find and remove them.
Security check
Mixed content and HTTPS: making every request encrypted
How http resources on an https page break security, how HSTS and upgrade-insecure-requests help, and how to find leftovers.
Security check
Subdomain takeover: dangling DNS records to clean up
How a forgotten DNS record pointing to a deleted service lets someone else serve content on your domain, and how to audit yours.
Security check
Vulnerable dependencies: auditing what your AI tool installed
How to audit npm packages for known vulnerabilities, avoid typosquats and unneeded packages, and keep updates manageable.
Security check
Mass assignment: stopping users from setting fields they should not
How passing a request body straight into a database update lets users change roles or prices, and how to allow-list fields.
Security check
Open redirects: keeping login and link flows from being abused
How unvalidated redirect parameters help phishing, and an allow-list approach for post-login and external links.
Security check
Server-side request forgery (SSRF): when your server fetches a URL for a user
How features that fetch user-supplied URLs, such as link previews and image imports, can reach internal systems, and how to restrict them.
Security check
Insecure file upload: validating what users send you
How to limit file type and size, store uploads safely and avoid serving user files in ways that run code.
Security check
Password reset flaws: making account recovery hard to abuse
The common mistakes in reset and email-verification flows, from guessable tokens to account enumeration, and how to fix them.
Want the scanner when it ships?
Join the waitlist. One email when it opens, nothing else.