Keep PII and Secrets Out of Logs
Prevent PII, tokens, prompts, and request data from entering logs through source minimization, field allowlists, tested redaction, and retention controls.
Security guidance for AI-built apps.
Read LyraShield AI research and practical guidance on securing AI-built apps, interpreting security evidence, verifying findings, and retesting fixes.
Browse by category
6 categories- Builder workflowsVibe-Coding SecurityPractical security habits for builders shipping apps written largely by AI coding tools.92articles
- Identity & data boundariesAccess ControlAuthentication, authorization, row-level security, and sessions — keeping the wrong people away from the right data.44articles
- Browser attack surfaceWeb SecurityHeaders, CORS, injection, and the rest of the browser-facing attack surface of a modern web app.40articles
- Dependencies & pipelinesSupply ChainDependencies, packages, CI/CD, and third-party services — securing the code you didn't write yourself.17articles
- Autonomy & guardrailsAgent SecurityPermissions, prompt injection, sandboxing, and guardrails for coding agents and agent-native applications.24articles
- Evidence & retestingVerificationChecking that findings are real and fixes actually hold: evidence, retesting, and honest security claims.91articles
More practical guidance
100 articles
Server-Side Authorization for AI-Generated APIs
Create one deny-by-default authorization seam for API actions, resources, and tenants, then test every sensitive path.
How to share a security report without leaking details
Share security reports safely with audience-specific copies, data minimization, verified redaction, controlled delivery, expiry, and revocation.
Security for solo founders who vibe code
A founder-sized security sequence for accounts, authorization, secrets, dependencies, recovery, monitoring, and release decisions.
Stop Shipping Source Maps and Private Build Artifacts
Inspect source maps, bundles, package tarballs, and CI artifacts before release so private source and files do not reach public storage.
SQL Injection in AI-Generated Code
Replace interpolated SQL values with bound parameters, map dynamic identifiers from allowlists, and test query builders safely.
SSRF Protection That Resolves DNS
Bind URL validation to DNS resolution and the connection, recheck redirects, block private destinations, and restrict egress.
Verify Stripe Webhook Signatures
Verify Stripe against the exact raw request body and the correct endpoint secret before parsing events or changing application state.
Supabase RLS for Vibe-Coded Apps
Build and test Supabase row-level security with precise grants, command policies, and two-account checks before release.
Secure Supabase Auth, RLS, and Service Keys
Secure the Supabase access chain from API grants and row-level security through user JWTs, server-only privileged keys, views, and functions.