Playbooks & production notes
Security
Security guidance for AI-built apps: authentication, authorization, tenant isolation, secrets, storage, and public endpoints.
The trust boundaries AI coding tools quietly skip: auth, row-level security, secrets, storage rules, and endpoints that never check who is calling. Written for founders shipping from Lovable, Base44, Cursor, or Claude Code. Start with "Vibe Coding Security: The Real Risk Ranking From 26 Audits", then "Is Lovable Safe?".
Security
A complete account deletion feature: related records, stored files, third-party copies, and the retention exceptions
Security
The admin panel security checklist: restricting admin routes and operations to verified roles
Security
Broken access control: enforcing permission on every route, endpoint and server action, and the test that proves it
Security
JWT security for a live app: expiry, refresh rotation, and revocation that actually revokes
Security
NIST minimum password length, and the rest of the current password guidance: what to set in your app and what to stop doing
Security
What is active session management: listing a user's devices and ending access from a lost phone
Security
The application security checklist for one web app: what to check, the test that proves it, and the evidence to keep
Security
Bots submitting our signup form: Turnstile or hCaptcha, the server check, and proof that real people still get through
Security
CSRF mitigation and CORS in production: which origins to allow, what credentialed requests do, and how to protect state-changing calls
Security
Defense in depth for an app you did not write: the layers you actually have
Security
How to detect Log4j vulnerability in what you run, and how to tell whether a published CVE is actually exploitable in your app
Security
How to set up a web application firewall or CDN in front of your app, and prove it absorbs a flood
Security
Man in the middle attack: what it is, how it works, and what actually stops one on a modern web app
Security
The npm malware package incidents: what the compromised versions did, and how to check your lockfile
Security
What a security review actually checks, and the baseline an early-stage startup needs before its first customers
Security
A security.txt file example, the disclosure contact behind it, and how to prove a report gets through
Security
Threat modelling a small web app: STRIDE without the ceremony
Security