Security for people who ship fast

Plain-language guides for finding exposed secrets and fixing vulnerabilities in AI-generated apps.

• Path Traversal: The CVSS 10 Bug Class in Your Own App

  GitLab just patched a CVSS 10.0 path traversal flaw that reads any file on the server. Here is what path traversal is, why AI-built apps ship it, and how to check yours.

• Is Bolt.new Safe? Vulnerabilities to Check Before You Ship

  Bolt.new ships fast, but almost every app has the same four security holes. Here's what to check - and how to scan your Bolt app before launch.

• Free Snyk Alternative for Indie Devs: Trust vs Snyk vs Gitleaks

  An honest comparison of Trust, Snyk, and Gitleaks for solo and vibe-coder devs. Free tiers, no-signup scans, DAST plus SAST plus secrets plus SCA, and when NOT to pick Trust.

• Next.js Security Checklist (2026): The Footguns AI Tools Ship

  A concrete Next.js App Router security checklist for 2026 - the mistakes AI tools and copy-paste ship (leaked env vars, middleware auth, Server Actions), each with a one-line fix.

• How to Find Exposed API Keys in a GitHub Repo (Free, No CLI)

  A plain-language guide to finding leaked API keys in a GitHub repo - built-in scanning, manual git history search, and why rotation beats deletion once a key is public.

• Is Lovable Safe? Security Issues in Lovable Apps (and How to Scan)

  Lovable ships apps fast - but the common failures are predictable: Supabase RLS left off, service-role keys in the client, unprotected endpoints. Here's how to check yours, free.

• Cursor Security: Scan AI-Written Code Without Leaving Your Editor

  Cursor writes code fast, but it reproduces classic vulns and leaks secrets. Here's what to check in AI-written code - and how to scan it right inside Cursor with Trust's MCP.

• NEXT_PUBLIC_ Leaked Your API Key: The Next.js / Vercel Bundle Trap

  In Next.js, any env var prefixed NEXT_PUBLIC_ is baked into the JavaScript your visitors download. Here's how secret keys leak this way, how to find them, and how to fix it.

• Supabase Service-Role Key Exposed? Here's Exactly What to Do

  Found your Supabase service_role key in client code or a public repo? It bypasses all your security. Here's exactly how to rotate it and lock things down - step by step.

• Is Your AI-Generated App Secure? A 5-Minute Check for Vibe Coders

  You built an app in a weekend with Cursor, Lovable, or v0. Here's what AI coding tools quietly get wrong about security - and how to find and fix it in 5 minutes, free.