App security
5 min read
Vibe-coded apps ship with real security debt
AI-assisted builds still need boring checks. Headers, cookies, exposed files and auth boundaries do not become optional because the first version worked.
Read and scanNews
Security notes for apps built at AI speed.
Practical writing on vibe-coded app security, website launch mistakes, and using Claude Code to turn findings into reviewed fixes. Every piece ends where the work does — with something you can check on your own site.
Website security
6 min read
The security checklist for vibe-coded websites
A practical pre-launch pass for sites built quickly with AI: the checks that catch public mistakes without turning the project into a month-long audit.
Read and scanClaude Code
5 min read
Using Claude Code to fix security findings safely
AI coding agents are strongest when the finding is specific, the desired behaviour is clear, and you ask for verification instead of blind edits.
Read and scanHeaders
4 min read
Why AI-built sites forget security headers
Generated code optimises for visible functionality. Security headers stay invisible until a scanner, a browser, or an attacker asks for them.
Read and scanSecrets
4 min read
Exposed env files still lose keys fastest
The oldest mistakes keep appearing in the newest stacks: public .env files, forgotten backups, and source maps with secrets inside them.
Read and scanCORS
4 min read
CORS is not a vibe setting
A wildcard origin can be harmless on a public asset endpoint and dangerous on an authenticated API. Know which one you actually shipped.
Read and scanAuth
5 min read
AI-generated auth needs server-side verification
If the server trusts a client session shape, a role string, or a hidden input, the app is not protected by the login screen it displays.
Read and scanCSP
5 min read
Prompting an agent to fix CSP safely
Content Security Policy is powerful and easy to over-tighten. Give your coding agent evidence, constraints, and a verification loop.
Read and scanLanding pages
4 min read
Landing pages leak more than you think
A static marketing page can still expose stack details, forgotten scripts, source maps, draft routes, and indexing mistakes.
Read and scanNext.js
5 min read
The fastest review for a Claude-built Next.js app
A short, practical loop for Next.js apps built with Claude Code: external scan first, then targeted source fixes, then scan again.
Read and scan