Security audits, vulnerability findings, and hardening guidance for AI-built and vibe-coded applications.
8 ways to security-scan an AI-built or vibe-coded app compared: Semgrep, Snyk, GitHub code scanning, SonarQube, Aikido, OWASP ZAP, manual pentests, and config-level scans. What each catches, what each misses, and typical 2026 pricing.
A pre-launch security pass for AI-built apps: bundled keys, missing RLS, open API routes. What I check in 20 reviews, and how to do it yourself in 90 minutes.
The exact mechanism that ships secret keys to the browser in AI-built apps, and the 5-minute grep that catches it before launch.
Someone found your anon key in the bundle. Is that a breach? Here's what the anon key actually grants, and the RLS mistake that turns it into one.
v0 generates real Next.js on real Vercel infra. Here's the env var that leaks to the browser, the service role key, and the server action nobody checks.
Bolt.new ships full-stack apps in minutes. Here's the RLS default and env-var trap its speed skips, plus a 90-second self-check.
A working checklist for Supabase security: RLS policies, anon keys, service role leaks, and the mistakes I keep finding in AI-built apps.
A data report on 66 live apps built with Lovable, Bolt, Cursor, base44, and Tempo. 41% of the Supabase-backed apps had at least one table anyone could read with the public anon key. Methodology, findings, and a 60-second self-check.