Vibe Coding
Lovable, Bolt, v0 & friends: what to check before you go live
AI app builders get you to a working product fast. This is a short, friendly list of the handful of things worth a quick look before you put it in front of real users.
The VerifiedApp Blog
Web security, secret leaks, misconfigurations and how to earn trust — straight from the scanner team.
Security Headers
Server & X-Powered-By version headers: free recon for attackers
Your responses may be broadcasting the exact version of your web server and framework. It is not a breach, but it hands attackers a head start. Here is how to turn it off.
Trust
The trust badge vs. the SSL padlock: what each one really proves
The padlock and a trust badge feel like the same 'this site is safe' signal. They are not. One proves the connection is encrypted; the other proves the site was actually checked.
Supply Chain
Axios and the 2026 wave: when your most-trusted package turns
The packages you trust most are the most valuable to compromise — because they are everywhere. Here is how a tainted dependency reaches your users, and how to limit the damage.
TLS/SSL
Certificate hostname mismatch, self-signed, untrusted: what each means
Three different certificate warnings, three different causes. Knowing which one you have is the difference between a five-minute fix and chasing the wrong problem.
Secrets
Google API keys & GCP service-account JSON in the open
A Google API key and a GCP service-account JSON file are not the same risk. One can be locked down; the other is a master key to your cloud project. Both leak the same way.
Exposed Files
Exposed SQL dumps: your database, downloadable
A database backup is just a file. Drop it in the wrong folder and your whole database — users, hashes, everything — becomes a single download away for anyone who tries the URL.
Security Headers
Mixed content: the HTTPS padlock that is lying to your users
Your page loads over HTTPS, the padlock shows, everything looks secure. Then one script loads over plain HTTP — and the secure channel you paid for has a hole in it.
Vibe Coding
Environment variables done right (and where they leak)
Env vars are how you keep secrets out of your code — until a build tool bakes them into the frontend bundle. Here is the part that actually decides whether they stay private.
Concepts
HTTPS vs. SSL vs. TLS: the terms, untangled
People say SSL, TLS and HTTPS as if they are the same thing. They are related but distinct — and one of them has been retired for years. Here is the clean version.
Cookies
SameSite cookies and CSRF: what None, Lax and Strict really do
SameSite is one word on your cookie that decides whether the browser sends it on requests coming from other sites. Get it wrong and you open the door to CSRF.
Secrets
Slack & Discord webhooks: the 'harmless' URLs that are not
A webhook URL feels like just a link, so it ends up committed and shipped to the browser. But that link is the credential — whoever holds it can post into your channel.