Identity & data boundaries
Access Control
Authentication, authorization, row-level security and sessions — keeping the wrong people away from the right data.
46published articles
46 published articles
Articles in this category
No guides match your search. Try a broader topic or clear the search to browse.
Copilot CLI App Security Checklist for Agents
A security checklist for reviewing apps built with GitHub Copilot CLI covering MCP config, secrets, dependencies and verifiable evidence with LyraShield AI.
Aug 7, 2026Copilot CLI MCP Security Workflow Setup Guide
Setup guide for the LyraShield MCP security workflow in GitHub Copilot CLI using the CLI, config files, verification and a GitHub Action diff gate.
Aug 7, 2026Keep AI Agents Away From Production Deletes
Block standing production delete authority with separate identities, permission ceilings, exact approvals, short-lived access and audit records.
Jul 17, 2026AI App Pre-Launch Security Checklist
Run an evidence-based pre-launch review across authorization, secrets, inputs, dependencies, deployment, agents, monitoring, recovery and retests.
Jul 17, 2026Why AI-Generated Tests Are Not Security Proof
Use AI-generated tests as regression checks, then add independent invariants, negative cases, mutation checks and scoped retest evidence.
Jul 17, 2026Secure an AI SaaS With Stripe
Secure Stripe billing with server-owned entitlements, raw-body webhook verification, idempotent processing, constrained keys and failure-path tests.
Jul 17, 2026Stop Exposing API Keys in Frontend Code
Identify secrets shipped in browser bundles, move privileged calls behind a server boundary and rotate exposed credentials safely.
Jul 17, 2026Secure a Base44 App Before Launch
Separate Base44 app visibility from data permissions, review table access and backend secrets, then verify the deployed app with distinct accounts.
Jul 17, 2026Secure a Bolt App Before Launch
Identify the Bolt backend, protect server functions and webhooks, test database policy and verify the published deployment.
Jul 17, 2026Stop Brute Force and Account Enumeration
Make authentication responses uniform, throttle online guessing by account and network signals and test recovery flows safely.
Jul 17, 2026Prevent CI/CD agents becoming confused deputies
Keep untrusted pull requests outside privileged CI jobs with narrow tokens, protected deployments, bound OIDC claims and verified artifacts.
Jul 17, 2026Why Client-Side Auth Is Not Access Control
Understand why route guards and hidden controls cannot enforce access, then place authorization at the server operation that needs it.
Jul 17, 2026Secure Cloudflare Workers Built With AI
Treat Worker bindings as capabilities, keep secrets encrypted, constrain outbound fetch and caching and verify routes with production-shaped Wrangler config.
Jul 17, 2026Secure FastAPI Code Generated by AI
Separate Pydantic request validation from object authorization, then configure CORS, hosts, proxy trust, TLS, errors and API documentation.
Jul 17, 2026Firebase security rules: Firestore and Storage
Test Firebase Firestore and Storage rules with two accounts. Review Admin SDK bypasses, upload limits and App Check before deployment.
Jul 17, 2026Vibe coding threat model: template and checklist
Build a threat model for your AI-built app with a worked example, reusable risk table, named owners and release checks tied to evidence.
Jul 17, 2026How to Find IDOR in an AI-Built App
Use a safe two-account test to find object authorization flaws, then fix the resource lookup instead of hiding identifiers.
Jul 17, 2026JWT Validation Mistakes AI Tools Generate
Validate JWT signatures, algorithms, issuers, audiences, time claims and token types with a deployment-specific trust policy.
Jul 17, 2026Design Least-Privilege MCP Tools
Narrow MCP tools by verb, resource, schema, token audience and approval so model-controlled calls cannot inherit broad authority.
Jul 17, 2026Secure a Lovable App Before Launch
Review a Lovable app across its public frontend, Edge Functions, database RLS, authentication, scans and publish settings.
Jul 17, 2026Prevent Mass Assignment in CRUD APIs
Stop request bodies from changing roles, owners, prices and workflow state with operation-specific schemas and explicit data writes.
Jul 17, 2026Stop prompt injection spreading across agents
Contain multi-agent prompt injection with preserved provenance, structured handoffs, separated capabilities, intent checks and safe canary tests.
Jul 17, 2026Prevent Cross-Tenant Data Leaks
Carry a server-owned tenant context through APIs, jobs, caches, storage and database queries, then verify it with two tenants.
Jul 17, 2026Secure a Next.js App Generated by AI
Treat every callable Next.js server entry as an API, centralize authorization in a server-only data layer and minimize data sent to the browser.
Jul 17, 2026Secure Node and Express APIs Generated by AI
Build an ordered Express request contract, authorize resources at every route and verify proxy, session, limit, error and dependency settings.
Jul 17, 2026Secure OAuth Redirects and Callbacks
Secure OAuth redirects with exact registration, transaction-bound callback state, PKCE, issuer checks and a strict code exchange.
Jul 17, 2026Password Hashing for Vibe Coders
Store passwords with maintained memory-hard hashing, deployment-tested work factors, safe migration and rehashing on login.
Jul 17, 2026Secure Password Reset and Email Verification
Design reset and verification flows with uniform responses, single-use tokens, trusted links and explicit session decisions.
Jul 17, 2026Keep Pricing and Entitlements Off the Client
Authorize paid features from server-owned entitlement state, reconcile provider updates and handle stale access without trusting client claims.
Jul 17, 2026Public-by-Default Deployments and Storage
Find exposed previews, app origins, database APIs and storage before launch, then prove each access boundary with logged-out and second-account tests.
Jul 17, 2026Secure React frontends: do not trust the browser
Use React's rendering protections correctly while keeping authorization, secrets, sensitive data and side effects behind verified server boundaries.
Jul 17, 2026Secure a Replit App Before Launch
Separate Replit Preview from production, choose the right deployment, protect secrets and APIs and inspect live response headers.
Jul 17, 2026Secure Admin Routes in AI-Built Apps
Inventory privileged actions, enforce one server-side policy across every method and test admin routes with ordinary accounts.
Jul 17, 2026Secure internal tools built by non-developers
Protect AI-built internal tools with managed identity, per-action authorization, narrow service accounts, audit logs, recovery and a shutdown owner.
Jul 17, 2026Build a Secure MCP Server
Secure an MCP server with deliberate transport choices, audience-bound tokens, per-tool authorization, session isolation and execution-time approval.
Jul 17, 2026Secure public AI API endpoints
Protect public AI APIs with object authorization, bounded work, cost controls, constrained tools, safe output handling and tested failure paths.
Jul 17, 2026Secure Session Cookies
Configure host-scoped session cookies, choose SameSite deliberately, rotate identifiers and test server-side expiry and revocation.
Jul 17, 2026Audit Logs for Security-Sensitive Actions
Design scoped audit events that reconstruct sensitive actions, resist silent changes, protect private data and survive collection failures.
Jul 17, 2026Build a Go / No-Go Security Launch Gate
Turn scoped security evidence into an accountable go, conditional, no-go or not-evaluated decision with owners and rollback readiness.
Jul 17, 2026Server-Side Authorization for AI-Generated APIs
Create one deny-by-default authorization seam for API actions, resources and tenants, then test every sensitive path.
Jul 17, 2026Supabase RLS for Vibe-Coded Apps
Build and test Supabase row-level security with precise grants, command policies and two-account checks before release.
Jul 17, 2026Supabase security: RLS and service keys
Review Supabase RLS, service-role bypasses and OAuth token storage. Test signed-out and cross-account access before releasing your app.
Jul 17, 2026Threat Modeling for Non-Security Founders
Build a lightweight startup threat model from assets, trust boundaries, misuse cases, mitigations, owners, tests and review triggers.
Jul 17, 2026The Two-Account Test for Data Isolation
Use two owned accounts and synthetic records to test object-level authorization across reads, writes, deletes, exports, files and nested resources.
Jul 17, 2026Vercel security: previews and env variables
Secure Vercel previews, keep private environment variables out of browser bundles and test deployment protection without weakening app authorization.
Jul 17, 2026Vibe Coding Security: The Complete Guide
A six-layer guide to testing AI-built apps, preserving evidence, retesting fixes and making an honest release decision.
Jul 17, 2026