Field notes on shipping secure.
Practical security for people who build fast with AI — the real footguns, and how to close them.
The 5 ways AI ships your secrets to the browser
Service-role keys, API tokens, admin URLs — the credentials that AI helpers routinely leave in the client bundle, and how to pull them back.
SupabaseRow-level security is off by default. Here’s what that costs you.
Anyone with your anon key can read every row until RLS is on. A walkthrough of the exposure and the policies that close it.
IDORBroken object-level auth: the bug in every /orders/:id
Why incrementing an ID still leaks other people’s data in 2026 — and the one check that stops it.
AI agentsPrompt injection is an access-control problem
Stop treating injection as a prompt-wording bug. The real fix is scoping what your agent’s tools are allowed to touch.
Post-launchDay-two vulnerabilities: why the launch-day scan isn’t enough
New CVEs and new code arrive after you ship. Monitoring is what turns a one-time grade into staying secure.
ProofSigned evidence: trust the math, not the testimonial
How Ed25519-signed remediation records let anyone verify a fix actually shipped — no vendor trust required.