Fixes
Fix the bugs AI tools leave behind
Exact fixes for the specific patterns AI coding assistants introduce most often. What each one is, why it matters, and the correct code.
rejectUnauthorized: false — what it does and how to fix itFix →Math.random() for tokens — why it's insecure and what to use insteadFix →Access-Control-Allow-Origin: * — the risk and the fixFix →SQL built with string concatenation — how to fix the injection riskFix →shell=True and exec with user input — fixing command injectionFix →Missing authentication on an API route — how to fix itFix →Cursor exposed my API key — how to fix itFix →Lovable exposed my Supabase key — how to fix itFix →Bolt exposed an API key — how to fix itFix →v0 hardcoded an API key — how to fix itFix →Replit exposed my API key — how to fix itFix →GitHub Copilot suggested a hardcoded API key — how to fix itFix →Windsurf exposed my API key — how to fix itFix →Base44 exposed my API key or data — how to fix itFix →Claude Code committed an API key — how to fix itFix →Codex committed an API key — how to fix itFix →dangerouslySetInnerHTML and XSS — how to fix itFix →eval() with user input — how to fix the code injection riskFix →Path traversal from user input — how to fix itFix →Open redirect — how to fix itFix →Storing passwords with MD5 or SHA-1 — how to fix itFix →SSRF from a user-supplied URL — how to fix itFix →XML external entity (XXE) — how to fix unsafe XML parsingFix →Insecure deserialization (pickle) — how to fix itFix →Lovable exposed my Supabase service_role key — how to fix itFix →v0 exposed my Supabase key — how to fix itFix →Cursor exposed my database URL — how to fix itFix →Replit exposed my OpenAI API key — how to fix itFix →Hardcoded JWT or session secret — how to fix itFix →Comparing a secret with === (timing attack) — how to fix itFix →Debug mode enabled in production — how to fix itFix →Bolt exposed my Supabase key — how to fix itFix →Databutton exposed an API key — how to fix itFix →Calling an API over HTTP instead of HTTPS — how to fix itFix →Logging passwords or tokens — how to fix itFix →NoSQL injection in MongoDB — how to fix itFix →No rate limiting on login (brute force) — how to fix itFix →Cursor committed my .env file — how to fix itFix →Lovable exposed an API key — how to fix itFix →Verifying a JWT without pinning the algorithm — how to fix itFix →Missing clickjacking protection (X-Frame-Options) — how to fix itFix →Insecure file upload — how to fix itFix →Mass assignment (spreading req.body into a model) — how to fix itFix →Codex exposed my database URL — how to fix itFix →Firebase Studio exposed my API key — is it a problem?Fix →yaml.load() without SafeLoader — why it's dangerous and how to fix itFix →Storing a JWT in localStorage — the XSS risk and how to fix itFix →Session cookie without httpOnly, secure, and sameSite — how to fix itFix →Catastrophic regex backtracking (ReDoS) — how to spot and fix itFix →Leaking stack traces and error details to the client — how to fix itFix →Hardcoded encryption key or IV — why it breaks your crypto and how to fix itFix →Missing CSRF protection on state-changing routes — how to fix itFix →Prototype pollution from unsafe object merge — how to fix itFix →