Security Blog

Test anonymous, owner, and other-user access across reads and writes, with a reusable matrix for each private resource.

A practical evidence map for AI-built apps: deployed scans, source review, and two-account authorization tests.

A historical snapshot of scanner-recorded findings across 1,119 distinct domains, with the collection window, methodology and limitations.

We wrote the security rules before the features and built an allowlist HTML sanitizer, then audited the result and found a Critical stored XSS, a full project takeover via a missing Postgres WITH CHECK, and a billing bypass. Every finding, including what we chose not to fix.

A guest post from LandingBoost: eight conversion checks to run before sending traffic to a vibe-coded SaaS landing page, with published experiment results and a 10-minute final review.

Tenant isolation, hardened Stripe webhooks, AI cost caps, and storage that fails closed. The security decisions behind Forecourtly, a multi-tenant SaaS for UK car dealers.

How vas helped Lotify, a Next.js + Supabase B2B marketplace for UK motor dealers, harden their AI-built platform before opening to traffic at scale.

A practical audit of the 7 Vercel-specific security issues we find in real apps: NEXT_PUBLIC_ leaks, preview exposure, log leakage, and more. Why platform incidents don't change the developer-side checklist.

Learn how to implement secure password handling in your vibe-coded app. Hashing, salting, password policies, and common mistakes to avoid.

Learn why SSL certificates matter for your vibe-coded app, how to avoid certificate expiry disasters, and what TLS version you should be using.

Learn why data breaches matter for vibe coders, how attackers use credential stuffing, and how to protect your accounts.

Learn why SPF and DMARC records are essential for your custom domain. Protect your users from phishing attacks and improve email deliverability.

Learn how to secure your Firebase app with proper Firestore rules, Authentication settings, and Cloud Functions security.

Deploying from Replit? Learn how to protect your secrets, secure your APIs, and configure proper authentication.

Turn findings into tested fixes using live scans, source review and permission tests. Includes a prompt for reviewing a finding with your coding tool.

Bolt.new makes building apps fast, but speed often comes at the cost of security. Learn the most common vulnerabilities and how to fix them.

A comprehensive guide to securing Lovable apps, from database security to API key management and beyond.

Taking your v0.dev generated components to production? Here's everything you need to know about security.