Learn
AI code security, explained
Plain-language answers to the security concepts behind AI-generated code, and why each one trips up vibe-coded apps.
What is Row Level Security (RLS) in Supabase?Read →Supabase anon key vs service_role key: what's the difference?Read →Why isn't an environment variable enough to hide a secret?Read →What are HTTP security headers?Read →What is a hardcoded secret, and why is it dangerous?Read →What is CORS, and why is a wildcard origin risky?Read →What is an API key, and how do you keep it safe?Read →What is SQL injection?Read →What is cross-site scripting (XSS)?Read →What is a JWT (JSON Web Token)?Read →Authentication vs authorization: what's the difference?Read →What is CSRF (Cross-Site Request Forgery)?Read →What is SSRF (Server-Side Request Forgery)?Read →What is command injection?Read →What is an environment variable (and why keep secrets in one)?Read →What is the OWASP Top 10?Read →What is a CWE (Common Weakness Enumeration)?Read →What is rate limiting (and why do you need it)?Read →What is clickjacking?Read →What is a Content Security Policy (CSP)?Read →What is password hashing (and why not just encrypt)?Read →What is IDOR (Insecure Direct Object Reference)?Read →What is prototype pollution?Read →What is insecure deserialization?Read →HTTPS vs HTTP: what's the difference and why it matters?Read →