Featured
SupabaseSupabase row-level security, explained for builders
If you only fix one thing before launch, make it this: which keys are safe in the browser, and how to make sure user A can never read user B's data.
Independent security journalism for AI-built apps
You built it with AI.
Now ship it safely.
Latest
All guides →
Cursor
How to vet an MCP server before you connect it to your coding agent
An MCP server can run code on your machine and feed instructions to your agent. How to check who publishes it, what tools it exposes and where it runs, how to limit the damage from injected instructions, and why to update your agent even without a CVE.
Trends
Your host says your secrets may be exposed: a rotation checklist
If your host reports that stored env vars may have been accessed: list every secret and copy, rotate database and backend keys first, revoke old values, handle paused deploys, cap spend, and check provider logs.
Trends
What to do if a dependency in your AI app's backend gets poisoned
A poisoned Python package release can run code every time Python starts, even if your app never imports it. How to check site-packages and Docker images, what to rotate from a clean machine, and how hashes, lockfiles, cooldowns and image digests help.
Supabase
Never let users edit the field your access rule trusts
If a rule decides access from a field on the user's own profile, like company, org_id or role, users must not be able to change it. How to spot it in Base44 and Supabase, and how to lock it down.
Trends
What changes for security when your AI-built app runs in your own cloud
When an AI-built app moves into your own AWS, Google Cloud or Azure account, more of the security work becomes yours. Who owns IAM, secrets, patching, auth, logging and network exposure, with a checklist.
Supabase
Supabase's Oct 30 change: new tables need a GRANT
From October 30, 2026, new public tables in existing Supabase projects aren't reachable through the Data API until you grant access. What changes, what the error looks like, and the safe fix.
Trends
How to judge a free security scanner for your AI-built app
What outside scanners can and can't see, what you should never paste into one, and how to check their findings yourself.
Lovable
Securing a Lovable app before you publish
Use the built-in Quick and Deep scans, keep API keys in Secrets, and review RLS before real users arrive.
Cursor
Rules, ignore files and safe agent settings in Cursor
Keep secrets away from coding agents, add security rules, and control what the agent is allowed to run.
Bolt
Bolt: database audit, secrets and server functions
Run Bolt Database's Security Audit, move credentials into Secrets, and protect your server functions.
Base44
Base44 permissions, service role and backend functions
Set row- and field-level security, use the service role safely, and run the built-in security scan.
Checklists
The pre-launch security checklist for AI-built apps
16 interactive checks to run before you share your app with real users. Progress saves in your browser.
How we work
37guides & checklists published
340official vendor docs cited
0ad trackers or tracking cookies
$0to read. No paywall, no scanner to sell
We don't test, rate or name anyone's app, and we don't publish testimonials we can't verify. Every claim links to the platform's own documentation.