Blog
Working ≠ Safe
Real security gaps in AI-generated code — what they are, why they pass every test, and the one-line fixes.
Any website can read your users' data
AI sets CORS to allow any origin with credentials — so a malicious site can call your API as a logged-in user and read their data. The one-line fix.
Read more →
Use one coupon a thousand times
AI checks a coupon then marks it used in two steps — so firing many requests at once slips them all through before any is marked used. A race condition.
Read more →
Your API keys are in your git history forever
AI commits your repo with .env included — so your live keys are in git history, and pushing to a public repo leaks them. Gitignore and rotate.
Read more →
One XSS and every login token is stolen
AI stores your auth token in localStorage — so any script on the page (one XSS) can read it and hijack the session. Use an httpOnly cookie instead.
Read more →
Your server can be tricked into leaking its own keys
AI fetches a URL the user provides without restriction — so an attacker points it at cloud metadata and steals your server's credentials. This is SSRF.
Read more →
Anyone can upload anything to your server
AI builds file upload with no type or size limit, saving the user's filename into a public folder — so someone uploads a script that runs on your domain.
Read more →
Anyone can reset anyone's password
AI builds password reset with a weak, never-expiring token — so an attacker can guess it and take over accounts. The one-line fix.
Read more →
AI accepts forged login tokens
AI verifies your login token but only decodes it — so anyone can edit the token, become admin, and the server trusts it. Why it happens and the one-line fix.
Read more →
Any logged-in user can hit your admin API
AI guards your admin routes by checking you're logged in — but never checks you're an admin. So any user can delete records. The one-line fix.
Read more →
Your login lets bots guess passwords forever
AI builds a login with no rate limit — so a bot can try a million passwords until one works. Why your tests pass and the one-line fix.
Read more →
Your API is shipping password hashes to the browser
AI returns the whole user row from your API, so the response includes password hashes, emails, and internal flags. Open the network tab and it's all there. The one-line fix.
Read more →
Set your own price to zero, and check out
AI trusts the price sent from the client, so a user can change it to 0 (or anything) and check out. Why your tests pass and the one-line fix that puts price back on the server.
Read more →
The AI endpoint that runs up a $10,000 bill
AI ships an AI feature with no auth and no rate limit, so anyone can loop it and bill you for thousands of calls. Why it happens and the one-line fix.
Read more →
One comment that steals every login
AI renders user comments as raw HTML, so a comment containing a script tag runs on every visitor's browser — stealing sessions. This is XSS, and the fix is one line.
Read more →
One input that dumps your whole database
AI pastes user input straight into your SQL query, so a single crafted input can read every row — or delete the table. This is SQL injection, and here's the one-line fix.
Read more →
Your secret API key is in your frontend. Press F12.
AI ships your AI, payment, or service-role key to the browser via NEXT_PUBLIC_. Anyone can read it in seconds. Why it happens and the one-line fix.
Read more →
How users give themselves a free paid plan in one request
AI saves the whole request body, so a user can add is_premium or role:admin and grant it to themselves. No payment, no permission. The one-line fix.
Read more →
Your Supabase login is decoration if RLS is off
AI leaves Row Level Security off, so the public anon key in your frontend can read and write your entire database from the browser. How to check and fix it.
Read more →
The one line of AI-generated code that leaks every user's data
AI builds a login that works — then lets any user read everyone else's data by changing one number. Why it passes every test, and the one-line fix.
Read more →
The fake webhook that hands out free premium
AI wires up Stripe but skips signature verification, so anyone can POST a fake 'paid' event and unlock premium for free. Here's the one-line fix.
Read more →