Blog
AI code security, explained
Practical answers to the questions developers actually ask about vibe coded and AI-generated app security.
HTTP security headers: the ones that matter and how to set themRead →“jwt.decode is not a function”: the fix, and the trap behind itRead →Why your NEXT_PUBLIC_ variable leaked a secret into the browserRead →Supabase service_role key exposed: what to do right nowRead →How to fix a “blocked by CORS policy” error (safely)Read →How to write Supabase RLS policies (with examples)Read →How to store API keys safely in a React or Next.js appRead →AI wrote my payment flow. Is it safe? Stripe security for vibe-coded appsRead →The npm packages your AI added that you never vettedRead →CORS vs CSRF: two confusingly-similar risks, explainedRead →How to add authentication to a vibe-coded app the right wayRead →Dev secrets in production: why environment separation mattersRead →What to log and what to never log in your appRead →Open redirects: how your own domain becomes a phishing toolRead →NoSQL injection: how a crafted object bypasses your MongoDB loginRead →Clickjacking: how an invisible frame hijacks your users' clicksRead →Mass assignment: the bug that lets users set fields they shouldn'tRead →XXE: how parsing XML can leak your server's filesRead →Timing attacks: why == is the wrong way to compare a tokenRead →Session cookies vs JWTs: which should your app use?Read →Storing user data safely: when to hash, when to encrypt, when to do neitherRead →Password reset flows: the security holes AI leaves in themRead →How to add a Content Security Policy to a Next.js appRead →How to remove a secret from git history (deleting the file isn't enough)Read →Webhook security: verify the signature, or anyone can fake your eventsRead →What a live-URL security scan can and can't findRead →Your API key is in an environment variable and it still leaked. Here's why.Read →How to check if your Supabase database is exposed (in 2 minutes)Read →Is my Firebase database open? How to check your security rulesRead →We checked real AI-built apps to see how many leave their database openRead →Broken access control: the bug AI puts in almost every appRead →How to secure an AI-built API in an afternoonRead →What actually happens when you push an API key to a public repoRead →Weak password hashing in AI code: why MD5 and SHA are not enoughRead →Insecure deserialization in AI code: how pickle and yaml.load run codeRead →Prototype pollution in AI code: the merge that rewrites every objectRead →ReDoS in AI-generated code: when one string freezes your serverRead →SSRF in AI-generated code: when a fetch-a-URL feature reaches your internal networkRead →Path traversal in AI-generated code: how ../ reads files off your serverRead →Insecure file upload in AI-built apps: what the assistant leaves outRead →XSS in React apps: using dangerouslySetInnerHTML without getting hackedRead →Command injection in AI-generated code: when user input reaches the shellRead →CORS misconfiguration in AI-generated code: the wildcard that opens your APIRead →SQL injection in AI-generated code: why it still happens and the one-line fixRead →Rate limiting: the protection your AI-built login is missingRead →How to give your AI coding tool secure-coding rules that actually workRead →The Supabase RLS checklist for AI-built appsRead →The insecure defaults AI coding tools ship (and how to catch them)Read →How to review AI-generated code for security before you mergeRead →Where to store a JWT: localStorage vs cookies in AI-built appsRead →How to stop Cursor, Copilot, and Claude Code from hardcoding your secretsRead →Your AI assistant hardcoded an API key and you pushed it. Do these 5 things now.Read →We ran Prbl and Semgrep on the same 17 repos. One reported 24 high-severity issues. One was real.Read →We scanned code from every major AI model to find the safest one. There isn't one.Read →Watch our scanner tear a vibe-coded app apart, finding by finding.Read →We scanned 120 web apps built with Cursor. Is Cursor-generated code secure?Read →Meta just entered the AI coding race. Its benchmarks don't answer the security question.Read →We scanned 83 apps built with OpenAI's Codex. They weren't the apps we expected.Read →We tested OpenAI's Codex and three Claude models for security. None was safer.Read →A Semgrep alternative built for AI-generated codeRead →Snyk vs Prbl: which one catches AI-generated code bugs?Read →We scanned nearly 2,000 AI-built apps. The same secret kept leaking.Read →The 4 security holes Claude Fable 5 leaves in your app (and the 2-minute fix for each)Read →We scanned web apps from three Claude model generations. Newer did not mean safer.Read →We scanned 119 web apps built with Claude Fable 5. The model got smarter. The secrets still leaked.Read →One default file explains most of the security gap between Lovable and BoltRead →We fixed our scanner 11 times in one week. Here's every fix.Read →More than 1 in 4 apps built with Lovable or Bolt has a high-severity security flaw. We checked.Read →1 in 3 repos shipped to Hacker News has a high-severity security flaw. We checked.Read →Our scanner flagged its own marketing copy as a leaked passwordRead →How we test Prbl: 113 repos, 303 regression tests, under 10% false positivesRead →How do I secure my vibe coded app?Read →What security vulnerabilities does AI-generated code have?Read →Is Cursor-generated code secure?Read →What does JWT decode without verify mean?Read →How do I find hardcoded secrets in my codebase?Read →What is a fallback secret in environment variables?Read →How do I prepare my SaaS for a security audit?Read →What is BOLA in web security?Read →