Blog
Research-backed notes on vibe-coded app security, taking prototypes to production, and making sites readable to search and AI answer engines. Every figure links to its source.
Security research4 min read
Researchers have now scanned thousands of AI-built apps and audited the agents that write them. The failures cluster in one place, and it is not the one most scanners look at.
Security research3 min read
When the browser talks to the database directly, row-level security is the only thing standing between a visitor and every row. A policy that exists is not the same as one that works.
Security research2 min read
A passive scan of 5,600 public apps turned up hundreds of live secrets and real personal data. Most of it was sitting in places any visitor's browser already downloads.
Security research2 min read
When five leading coding agents built the same apps, none wrote SQL injection. All of them skipped the security controls the prompt never mentioned.
Security research2 min read
Researchers have started tracing published vulnerabilities back to the AI tools that wrote the code. The count is small, rising fast, and almost certainly an undercount.
Security research2 min read
A static scanner can tell you a query is unsafe. It cannot tell you that User B should not be able to read invoice 42. That rule lives in your business, not your syntax.
Security research2 min read
Every rewrite an agent makes can leave an old route behind. The interface forgets it. The server does not.
Shipping2 min read
The prototype works. Before real users arrive, there is a short list of things that separate a demo from a product, and most of them take an afternoon.
SEO & GEO2 min read
Most AI crawlers read the HTML your server sends and stop there. If your content only appears after JavaScript runs, they see an empty page.
SEO & GEO2 min read
A single line in robots.txt can remove a site from every answer engine. Generated sites ship with a few of these lines more often than you would think.
