Browser attack surface
Web Security
Headers, CORS, injection and the rest of the browser-facing attack surface of a modern web app.
43published articles
43 published articles
Articles in this category
No guides match your search. Try a broader topic or clear the search to browse.
Insecure File Upload in AI-Built Apps
Why AI generated file upload code fails open, what attackers abuse and how to verify type size and storage safely in production.
Sep 25, 2026What Building Release Assurance Taught Me
Honest founder notes on shipping LyraShield AI in open beta, why evidence beats flagging and how we handle fix proposals.
Sep 23, 2026Race Conditions in AI-Built Apps and Fixes
Learn how AI generated handlers create race conditions, why check then act fails and how to fix with atomic updates and constraints.
Sep 21, 2026AI App Pre-Launch Security Checklist
Run an evidence-based pre-launch review across authorization, secrets, inputs, dependencies, deployment, agents, monitoring, recovery and retests.
Jul 17, 2026Privacy checklist for AI-built apps
Map personal data, purposes, retention, processors, user rights, deletion and incident handling before an AI-built app reaches real users.
Jul 17, 2026Secure an AI SaaS With Stripe
Secure Stripe billing with server-owned entitlements, raw-body webhook verification, idempotent processing, constrained keys and failure-path tests.
Jul 17, 2026Secure a Bolt App Before Launch
Identify the Bolt backend, protect server functions and webhooks, test database policy and verify the published deployment.
Jul 17, 2026Stop Brute Force and Account Enumeration
Make authentication responses uniform, throttle online guessing by account and network signals and test recovery flows safely.
Jul 17, 2026Secure Cloudflare Workers Built With AI
Treat Worker bindings as capabilities, keep secrets encrypted, constrain outbound fetch and caching and verify routes with production-shaped Wrangler config.
Jul 17, 2026Command Injection in Agentic App Workflows
Remove unsafe shell boundaries from agent tools, constrain process arguments and isolate the external commands that remain necessary.
Jul 17, 2026CORS for Vibe-Coded Apps
Replace wildcard or reflected origins with a minimal browser-sharing policy, correct credential handling and cache-safe headers.
Jul 17, 2026CSRF Protection for Cookie-Based AI Apps
Protect cookie-authenticated state changes with framework controls or verified tokens, plus SameSite and Fetch Metadata layers.
Jul 17, 2026Remove Debug Routes and Verbose Errors
Stop production errors from exposing stack traces, paths, queries and framework internals while preserving useful, access-controlled diagnostics.
Jul 17, 2026Secure FastAPI Code Generated by AI
Separate Pydantic request validation from object authorization, then configure CORS, hosts, proxy trust, TLS, errors and API documentation.
Jul 17, 2026Firebase security rules: Firestore and Storage
Test Firebase Firestore and Storage rules with two accounts. Review Admin SDK bypasses, upload limits and App Check before deployment.
Jul 17, 2026Idempotency and Replay Protection for SaaS
Make retries and duplicate webhooks safe with durable operation keys, canonical request binding, atomic state changes and stored results.
Jul 17, 2026Input Validation for AI-Generated APIs
Define strict server-side request schemas, reject unknown and oversized data and enforce business invariants before processing.
Jul 17, 2026Secure a Lovable App Before Launch
Review a Lovable app across its public frontend, Edge Functions, database RLS, authentication, scans and publish settings.
Jul 17, 2026Prevent Mass Assignment in CRUD APIs
Stop request bodies from changing roles, owners, prices and workflow state with operation-specific schemas and explicit data writes.
Jul 17, 2026Secure a Next.js App Generated by AI
Treat every callable Next.js server entry as an API, centralize authorization in a server-only data layer and minimize data sent to the browser.
Jul 17, 2026Secure Node and Express APIs Generated by AI
Build an ordered Express request contract, authorize resources at every route and verify proxy, session, limit, error and dependency settings.
Jul 17, 2026Secure OAuth Redirects and Callbacks
Secure OAuth redirects with exact registration, transaction-bound callback state, PKCE, issuer checks and a strict code exchange.
Jul 17, 2026Prevent Path Traversal in Generated File Code
Keep file reads, exports and archive extraction inside a trusted directory with canonical containment checks and safer identifiers.
Jul 17, 2026Find Placeholder Logic and Silent Failures
Find generated code that reports success without completing the promised work, then verify durable state, failure behavior and a fresh retest.
Jul 17, 2026Rate Limiting for AI Apps
Design endpoint-specific rate, concurrency, payload, queue and cost limits for AI APIs without trusting a single weak identifier.
Jul 17, 2026Secure React frontends: do not trust the browser
Use React's rendering protections correctly while keeping authorization, secrets, sensitive data and side effects behind verified server boundaries.
Jul 17, 2026Secure a Replit App Before Launch
Separate Replit Preview from production, choose the right deployment, protect secrets and APIs and inspect live response headers.
Jul 17, 2026SAST vs DAST vs SCA for AI-Built Apps
Compare the evidence, timing, targets and blind spots of SAST, DAST and SCA, then combine them into a practical release workflow.
Jul 17, 2026Secure File Uploads in AI-Built Apps
Build a staged upload pipeline with early size limits, server-generated names, content checks, quarantine and private delivery.
Jul 17, 2026Secure public AI API endpoints
Protect public AI APIs with object authorization, bounded work, cost controls, constrained tools, safe output handling and tested failure paths.
Jul 17, 2026Secure Session Cookies
Configure host-scoped session cookies, choose SameSite deliberately, rotate identifiers and test server-side expiry and revocation.
Jul 17, 2026Security Headers Every AI-Built App Needs
Build browser security headers from application behavior, stage CSP safely and verify policies by route instead of chasing a score.
Jul 17, 2026Build a Go / No-Go Security Launch Gate
Turn scoped security evidence into an accountable go, conditional, no-go or not-evaluated decision with owners and rollback readiness.
Jul 17, 2026Security Monitoring and Alerts Before Launch
Define security events, route actionable alerts to an owner and test the complete monitoring path before an AI-built app launches.
Jul 17, 2026Keep PII and Secrets Out of Logs
Prevent PII, tokens, prompts and request data from entering logs through source minimization, field allowlists, tested redaction and retention controls.
Jul 17, 2026SQL Injection in AI-Generated Code
Replace interpolated SQL values with bound parameters, map dynamic identifiers from allowlists and test query builders safely.
Jul 17, 2026SSRF Protection That Resolves DNS
Bind URL validation to DNS resolution and the connection, recheck redirects, block private destinations and restrict egress.
Jul 17, 2026Verify Stripe Webhook Signatures
Verify Stripe against the exact raw request body and the correct endpoint secret before parsing events or changing application state.
Jul 17, 2026Supabase security: RLS and service keys
Review Supabase RLS, service-role bypasses and OAuth token storage. Test signed-out and cross-account access before releasing your app.
Jul 17, 2026TLS and Mobile Transport Security
Remove cleartext exceptions from mobile releases, test the real networking stack and verify certificates, redirects and backend TLS.
Jul 17, 2026Secure a v0-Generated App
Trace a v0 app from generated code through Next.js server boundaries, Vercel previews, environment variables and the deployed site.
Jul 17, 2026Vercel security: previews and env variables
Secure Vercel previews, keep private environment variables out of browser bundles and test deployment protection without weakening app authorization.
Jul 17, 2026XSS in AI apps that render model output
Trace untrusted Markdown and model output through parsing, sanitization, DOM insertion, CSP and safe local verification.
Jul 17, 2026