Security guidance for AI-built apps.

Read LyraShield AI research and practical guidance on securing AI-built apps, interpreting security evidence, verifying findings, and retesting fixes.

Follow via RSS

Browse by category

6 categories

Builder workflowsVibe-Coding SecurityPractical security habits for builders shipping apps written largely by AI coding tools.92articles
Identity & data boundariesAccess ControlAuthentication, authorization, row-level security, and sessions — keeping the wrong people away from the right data.44articles
Browser attack surfaceWeb SecurityHeaders, CORS, injection, and the rest of the browser-facing attack surface of a modern web app.40articles
Dependencies & pipelinesSupply ChainDependencies, packages, CI/CD, and third-party services — securing the code you didn't write yourself.17articles
Autonomy & guardrailsAgent SecurityPermissions, prompt injection, sandboxing, and guardrails for coding agents and agent-native applications.24articles
Evidence & retestingVerificationChecking that findings are real and fixes actually hold: evidence, retesting, and honest security claims.91articles

More practical guidance

100 articles

A dependency lattice connected by version rings and provenance joints

Jul 17, 20267 min read

Dependency Scanning With OSV and Lockfiles

Scan resolved dependencies with OSV Scanner v2, interpret advisory matches, manage exceptions, update safely, and verify the result.

Data signals entering a constrained execution funnel while other paths are blocked

Jul 17, 20266 min read

Password Hashing for Vibe Coders

Store passwords with maintained memory-hard hashing, deployment-tested work factors, safe migration, and rehashing on login.

A scoped identity and action path crossing rate, verification, and authorization checkpoints

Jul 17, 20266 min read

Secure Password Reset and Email Verification

Design reset and verification flows with uniform responses, single-use tokens, trusted links, and explicit session decisions.

A server request or path corridor crossing input, authorization, and destination-boundary rechecks

Jul 17, 20266 min read

Prevent Path Traversal in Generated File Code

Keep file reads, exports, and archive extraction inside a trusted directory with canonical containment checks and safer identifiers.

Trusted evidence converging on a controlled decision core with scoped action and release paths

Jul 17, 20266 min read

Keep Pricing and Entitlements Off the Client

Authorize paid features from server-owned entitlement state, reconcile provider updates, and handle stale access without trusting client claims.

A changed or placeholder component retested while a false-success path stops before durable state

Jul 17, 20267 min read

Find Placeholder Logic and Silent Failures

Find generated code that reports success without completing the promised work, then verify durable state, failure behavior, and a fresh retest.

Jul 17, 20266 min read

How to prioritize security findings

Prioritize security findings with exploitation, reachability, impact, asset context, confidence, and accountable remediation decisions.

A sealed build artifact moving through a controlled deployment corridor

Jul 17, 20266 min read

When a vibe-coded prototype becomes production

A prototype becomes production when failure or misuse can affect real people, data, money, access, obligations, or business operations.

A restricted route passing through two policy locks

Jul 17, 20266 min read

Public-by-Default Deployments and Storage

Find exposed previews, app origins, database APIs, and storage before launch, then prove each access boundary with logged-out and second-account tests.

Client requests crossing origin, protected transport, and capacity gates

Jul 17, 20266 min read

Rate Limiting for AI Apps

Design endpoint-specific rate, concurrency, payload, queue, and cost limits for AI APIs without trusting a single weak identifier.