Blog
AI code security, explained
Practical answers to the questions developers actually ask about vibe coded and AI-generated app security.
Scan your own app for these issues
Paste your live URL. We check what your app serves publicly for exposed keys and misconfigurations. No account, no install.
HTTP security headers: the ones that matter and how to set themRead →“jwt.decode is not a function”: the fix, and the trap behind itRead →Why your NEXT_PUBLIC_ variable leaked a secret into the browserRead →Supabase service_role key exposed: what to do right nowRead →How to fix a “blocked by CORS policy” error (safely)Read →How to write Supabase RLS policies (with examples)Read →How to store API keys safely in a React or Next.js appRead →AI wrote my payment flow. Is it safe? Stripe security for vibe-coded appsRead →The npm packages your AI added that you never vettedRead →CORS vs CSRF: two confusingly-similar risks, explainedRead →How to add authentication to a vibe-coded app the right wayRead →Dev secrets in production: why environment separation mattersRead →What to log and what to never log in your appRead →Open redirects: how your own domain becomes a phishing toolRead →NoSQL injection: how a crafted object bypasses your MongoDB loginRead →Clickjacking: how an invisible frame hijacks your users' clicksRead →Mass assignment: the bug that lets users set fields they shouldn'tRead →XXE: how parsing XML can leak your server's filesRead →Timing attacks: why == is the wrong way to compare a tokenRead →Session cookies vs JWTs: which should your app use?Read →Storing user data safely: when to hash, when to encrypt, when to do neitherRead →Password reset flows: the security holes AI leaves in themRead →How to add a Content Security Policy to a Next.js appRead →How to remove a secret from git history (deleting the file isn't enough)Read →Webhook security: verify the signature, or anyone can fake your eventsRead →What a live-URL security scan can and can't findRead →Your API key is in an environment variable and it still leaked. Here's why.Read →How to check if your Supabase database is exposed (in 2 minutes)Read →Is my Firebase database open? How to check your security rulesRead →Is Lovable safe? An honest breakdownRead →Is Bolt.new safe? An honest breakdownRead →Is Cursor safe? The IDE CVEs and the code it writesRead →We scanned 2,736 AI-built apps to see how many leave the door unlockedRead →We checked real AI-built apps to see how many leave their database openRead →Broken access control: the bug AI puts in almost every appRead →How to secure an AI-built API in an afternoonRead →What actually happens when you push an API key to a public repoRead →Weak password hashing in AI code: why MD5 and SHA are not enoughRead →Insecure deserialization in AI code: how pickle and yaml.load run codeRead →Prototype pollution in AI code: the merge that rewrites every objectRead →ReDoS in AI-generated code: when one string freezes your serverRead →SSRF in AI-generated code: when a fetch-a-URL feature reaches your internal networkRead →Path traversal in AI-generated code: how ../ reads files off your serverRead →Insecure file upload in AI-built apps: what the assistant leaves outRead →XSS in React apps: using dangerouslySetInnerHTML without getting hackedRead →Command injection in AI-generated code: when user input reaches the shellRead →CORS misconfiguration in AI-generated code: the wildcard that opens your APIRead →SQL injection in AI-generated code: why it still happens and the one-line fixRead →Rate limiting: the protection your AI-built login is missingRead →How to give your AI coding tool secure-coding rules that actually workRead →The Supabase RLS checklist for AI-built appsRead →The insecure defaults AI coding tools ship (and how to catch them)Read →How to review AI-generated code for security before you mergeRead →Where to store a JWT: localStorage vs cookies in AI-built appsRead →How to stop Cursor, Copilot, and Claude Code from hardcoding your secretsRead →Your AI assistant hardcoded an API key and you pushed it. Do these 5 things now.Read →We ran Prbl and Semgrep on the same 17 repos. One reported 24 high-severity issues. One was real.Read →We scanned code from every major AI model to find the safest one. There isn't one.Read →Watch our scanner tear a vibe-coded app apart, finding by finding.Read →We scanned 120 web apps built with Cursor. Is Cursor-generated code secure?Read →Meta just entered the AI coding race. Its benchmarks don't answer the security question.Read →We scanned 83 apps built with OpenAI's Codex. They weren't the apps we expected.Read →We tested OpenAI's Codex and three Claude models for security. None was safer.Read →A Semgrep alternative built for AI-generated codeRead →Snyk vs Prbl: which one catches AI-generated code bugs?Read →We scanned nearly 2,000 AI-built apps. The same secret kept leaking.Read →The 4 security holes Claude Fable 5 leaves in your app (and the 2-minute fix for each)Read →We scanned web apps from three Claude model generations. Newer did not mean safer.Read →We scanned 119 web apps built with Claude Fable 5. The model got smarter. The secrets still leaked.Read →One default file explains most of the security gap between Lovable and BoltRead →We fixed our scanner 11 times in one week. Here's every fix.Read →More than 1 in 4 apps built with Lovable or Bolt has a high-severity security flaw. We checked.Read →1 in 3 repos shipped to Hacker News has a high-severity security flaw. We checked.Read →Our scanner flagged its own marketing copy as a leaked passwordRead →How we test Prbl: 113 repos, 303 regression tests, under 10% false positivesRead →How do I secure my vibe coded app?Read →What security vulnerabilities does AI-generated code have?Read →Is Cursor-generated code secure?Read →What does JWT decode without verify mean?Read →How do I find hardcoded secrets in my codebase?Read →What is a fallback secret in environment variables?Read →How do I prepare my SaaS for a security audit?Read →What is BOLA in web security?Read →