Blog · 21 posts
Security and compliance
Protecting data and meeting the rules your customers hold you to.
Security and compliance · 7 Aug 2026 · 6 min read
My Supabase RLS Policy Is Not Working
A debugging order for Supabase row-level security when policies seem ignored or block everything, including the service-role trap and the tests that prove it.
Security and compliance · 6 Aug 2026 · 6 min read
Someone Found My API Key. What Do I Do Right Now?
A calm, ordered playbook for the hour after you discover an API key leaked: rotate the right things first, read the logs, and purge the key from history.
Security and compliance · 4 Aug 2026 · 8 min read
My App Works for Me but Not for Other Users
A diagnostic guide for the app that works perfectly on your account and breaks for every other user, including the security problems hiding behind the symptom.
Security and compliance · 3 Aug 2026 · 7 min read
Can an AI-Generated App Be HIPAA Compliant?
Yes, an app built with AI tooling can be HIPAA compliant — but only after you fix the BAA gaps, PHI leakage into third-party tools, and missing audit trail.
Security and compliance · 3 Aug 2026 · 7 min read
Taking Payments Safely in an AI-Built Product
How to take card payments in an AI-built product without inheriting PCI scope — plus the pricing, webhook, and script-integrity bugs generators reliably produce.
Security and compliance · 3 Aug 2026 · 8 min read
ISO 27001 for an Early-Stage Product Team
A practical breakdown of ISO 27001 for a startup with a small team — what the standard asks for, what your code has to prove, and when certification is worth starting.
Security and compliance · 2 Aug 2026 · 7 min read
Passing Technical Due Diligence With an AI-Generated Codebase
What a technical due diligence team looks for in an AI-generated codebase, which findings actually threaten a deal, and how to prepare before the data room opens.
Security and compliance · 2 Aug 2026 · 7 min read
SOC 2 When an AI Wrote Your Code
SOC 2 audits controls, not code quality — but AI-built products systematically fail the control tests. Here is which ones, what it costs, and how to close the gaps.
Security and compliance · 2 Aug 2026 · 7 min read
Answering Enterprise Security Questionnaires as a Small Team
How a three-person team answers a 300-row enterprise security questionnaire without lying, stalling, or losing the deal — and what to build before the next one arrives.
Security and compliance · 2 Aug 2026 · 7 min read
GDPR Obligations Your AI-Built App Probably Missed
The GDPR requirements AI code generators never implement — real deletion, lawful basis, subprocessor disclosure, retention, and breach readiness — and how to close them.
Security and compliance · 1 Aug 2026 · 7 min read
What a Security Audit Costs for an AI-Built Product
Quotes for the same security audit routinely differ by a factor of ten. Here is what actually drives the number, and how to buy the right depth for your situation.
Security and compliance · 1 Aug 2026 · 7 min read
Auditing the Dependencies an AI Chose for You
How to run a dependency audit on an AI-generated npm project — spotting hallucinated packages, unmaintained libraries, license risk, and the CVEs that actually matter.
Security and compliance · 31 Jul 2026 · 7 min read
Finding Every Secret an AI Left in Your Repo
AI-assisted commits leak credentials at roughly twice the baseline rate. Here is how to sweep an entire repo — history included — and what to do with what you find.
Security and compliance · 31 Jul 2026 · 7 min read
Do You Need a Pen Test for an AI-Built App?
A pen test is a proof, not a discovery process. How to tell whether your AI-built app needs one now — and what to do first so you are not paying for a list you could have written.
Security and compliance · 30 Jul 2026 · 6 min read
Your API Keys Are in the Frontend. Here Is What to Do Today.
A same-day plan for API keys shipped in client code: confirm the exposure, rotate in the right order, assess the damage, and fix the architecture that caused it.
Security and compliance · 30 Jul 2026 · 7 min read
A Security Checklist for Apps You Did Not Write Line by Line
A working checklist for founders who shipped fast with an AI builder and now need to know the app is safe — every item with a way to verify it yourself.
Security and compliance · 29 Jul 2026 · 6 min read
Vibe Coding Security Risks: What the 2026 Research Actually Found
What published research says about the security of AI-generated code, why the failures cluster where they do, and the fixes that address the actual findings.
Security and compliance · 29 Jul 2026 · 6 min read
Row Level Security Mistakes in AI-Generated Supabase Apps
Eight Row Level Security failures we find repeatedly in AI-built Supabase apps, why the generator produces them, and the test that actually proves a policy works.
Security and compliance · 22 Jul 2026 · 8 min read
What an AI Code Audit Costs and What You Actually Get
What an audit of an AI-generated codebase costs, what the report should contain, and how to judge whether the one you were sent is worth what you paid.
Security and compliance · 18 Jul 2026 · 9 min read
Website Security Audit: What It Checks and When You Need One
A plain-English guide to what a website security audit actually checks, the triggers that mean you need one now, and how to read the report.
Security and compliance · 18 Jul 2026 · 9 min read
GDPR-Compliant AI: Data Residency and Privacy for LLM Apps
A practical guide to GDPR-compliant AI for LLM apps — data residency, lawful basis, DPAs, subject rights, and the architecture that makes EU privacy work.