Security
Real findings from real audits — security, speed and SEO explained in plain language.
The complete security checklist for AI-built sites (Lovable, Bolt, v0, Cursor)
An AI can ship a working app in an afternoon — and leave a dozen doors unlocked. This is the full checklist I run against AI-built sites, in the order the findings actually bite.
July 19, 2026
One website audit or a dozen browser tabs? All-in-one vs single-purpose scanners
There's a great free tool for each of security headers, SSL, DNS, speed, SEO and cookies. Running all of them, reconciling the results, and knowing what actually matters is the real work. The case for a single scan.
July 19, 2026
Supabase RLS: the one setting that decides who reads your data
Row Level Security is the difference between a private database and a public one — and it's the setting AI builders quietly skip. What RLS is, how to tell if yours is off, and how to switch it on without breaking your app.
July 18, 2026
How scrapers find your exposed API key within hours of launch
Put a Stripe or OpenAI key in your frontend and it isn't hidden — it's published. How automated scrapers find bundled keys within hours, why 'it's only the frontend' is a myth, and how to move the key server-side.
July 18, 2026
The scanner said the site was clean. Then I read the code.
A deep audit of one platform turned up 40 issues — four of them critical. Not one of the four would show up on an automated scan. Here's why, and what it means for your site.
July 17, 2026
The security headers your site is probably missing
A handful of HTTP response headers switch off whole classes of attack — and cost nothing but a few lines of config. Here's what each one does, in plain language.
July 16, 2026
5 security holes I find on almost every AI-built site
AI tools like Lovable, v0 and Bolt build a site in an afternoon — and just as fast, build in the same mistakes over and over. Here are the five most common.
July 14, 2026
Why an exposed .env is a catastrophe (and how to fix it in a minute)
One file, one request, and an attacker holds the keys to your database and your payment gateway. Why it happens, and how to close it for good.
July 10, 2026