Security writing for people
building real software.
Field notes from auditing AI-generated codebases. Patterns we see, fixes that work, and what the next wave of code is doing to security.
More articles
8 posts
Case Study7 min readMeta's own AI helped hackers take over 20,000 Instagram accounts
One missing validation check. Six weeks undetected. More than 20,000 Instagram accounts handed to attackers by the very tool Meta built to help people get them back.
Logic Gap Files5 min readYour AI wrote your Stripe integration. It also handed attackers the keys to your revenue.
Most founders do not discover this mistake from a security audit. They discover it from a Stripe email telling them something is wrong. By then, the damage is already done.
Case Study11 min readHackers used stolen Claude and Codex agents to breach 14 companies. They never wrote a single line of code.
One stolen development environment. More than 1,000 sessions run by an attacker posing as an authorized penetration tester. Fourteen companies breached. And the attacker's most powerful tool was not a piece of malware. It was a sentence.
Logic Gap Files3 min readJWT in localStorage: the auth mistake AI coding tools make by default
AI coding tools write working login flows. The problem is that working and secure are not the same thing. When you ask an AI to handle authentication, it almost always stores your JWT in localStorage and that single decision puts every active user session at risk.
Security7 min readWhy AI Struggles with Authentication: Securing Trust Boundaries in Vibe-Coded Apps
AI builds the frontend and forgets the server. Here is why vibe-coded apps ship with broken trust boundaries, missing auth middleware, and BOLA flaws.
Security7 min readWhy Traditional Static Analysis Fails Vibe-Coded Apps
Traditional static analysis passes AI code that compiles but behaves insecurely. Here is why SAST tools like Semgrep miss the logic flaws in vibe-coded apps.
Security9 min read5 Common Security Hallucinations in Cursor and Bolt.new
AI security hallucinations are the hidden flaws Cursor and Bolt.new leave behind, from slopsquatting to open API routes. Here are the five we see most often.
Security5 min readThe Vibe-Coder's Manifesto: Why Vibe-Coding Security is the New Standard
Vibe-coding security is a branch of AI-coding security. It focuses on finding logic-based flaws in apps made by AI agents like Cursor or Bolt.new.