Security, without the jargon.

For founders who build with AI, whichever tool writes the code, and would rather not learn security the hard way. Real incidents, the research behind them, and what to check this week.

Topics:#vibe-coding #api-keys #row-level-security #supabase #ai-generated-code #data-breach #lovable #access-control #ai-features #cursor #firebase #gdpr #rate-limiting #research

1 article tagged #owasp

Clear filters

Guides13 Oct 2026

Change one number in the URL. If you see someone else's data, you have the most common serious flaw on the web.

Your invoice page is /invoices/1042. What happens if a customer types 1041? For a surprising number of apps, they see another customer's invoice. Here's why AI-built apps are prone to this, and a ten-minute test.

4 min read

Launching soon?

The free pre-launch checklist has the twenty checks we would run first, in the order we would run them. No email, no account.

Open the checklist RSS

Security, without the jargon.

Results

Change one number in the URL. If you see someone else's data, you have the most common serious flaw on the web.

Launching soon?