Secure npm Install Scripts and Transitive Dependencies
Inspect dependency scripts before they execute, install without production credentials, and allow only reviewed lifecycle code in npm.
Security guidance for AI-built apps.
Read LyraShield AI research and practical guidance on securing AI-built apps, interpreting security evidence, verifying findings, and retesting fixes.
Browse by category
6 categories- Builder workflowsVibe-Coding SecurityPractical security habits for builders shipping apps written largely by AI coding tools.92articles
- Identity & data boundariesAccess ControlAuthentication, authorization, row-level security, and sessions — keeping the wrong people away from the right data.44articles
- Browser attack surfaceWeb SecurityHeaders, CORS, injection, and the rest of the browser-facing attack surface of a modern web app.40articles
- Dependencies & pipelinesSupply ChainDependencies, packages, CI/CD, and third-party services — securing the code you didn't write yourself.17articles
- Autonomy & guardrailsAgent SecurityPermissions, prompt injection, sandboxing, and guardrails for coding agents and agent-native applications.24articles
- Evidence & retestingVerificationChecking that findings are real and fixes actually hold: evidence, retesting, and honest security claims.91articles
More practical guidance
100 articles
JWT Validation Mistakes AI Tools Generate
Validate JWT signatures, algorithms, issuers, audiences, time claims, and token types with a deployment-specific trust policy.
Design Least-Privilege MCP Tools
Narrow MCP tools by verb, resource, schema, token audience, and approval so model-controlled calls cannot inherit broad authority.
Secure a Lovable App Before Launch
Review a Lovable app across its public frontend, Edge Functions, database RLS, authentication, scans, and publish settings.
Prevent Mass Assignment in CRUD APIs
Stop request bodies from changing roles, owners, prices, and workflow state with operation-specific schemas and explicit data writes.
Stop Prompt Injection From Spreading Across Agents
Contain multi-agent prompt injection with preserved provenance, structured handoffs, separated capabilities, intent checks, and safe canary tests.
Prevent Cross-Tenant Data Leaks
Carry a server-owned tenant context through APIs, jobs, caches, storage, and database queries, then verify it with two tenants.
Secure a Next.js App Generated by AI
Treat every callable Next.js server entry as an API, centralize authorization in a server-only data layer, and minimize data sent to the browser.
Secure Node and Express APIs Generated by AI
Build an ordered Express request contract, authorize resources at every route, and verify proxy, session, limit, error, and dependency settings.
Secure OAuth Redirects and Callbacks
Secure OAuth redirects with exact registration, transaction-bound callback state, PKCE, issuer checks, and a strict code exchange.