Secrets
Database connection strings in the open: Postgres, MySQL, MongoDB
A connection string is a username, password, host and database name in one line — the keys to your entire database. Here is how they get exposed and how to keep them private.
Tag
#appsec
Vibe Coding
A security review for AI-generated code: a practical checklist
AI tools get you to a working app fast. They optimise for 'it runs', not 'it is safe to expose'. Here is a short, concrete review to run before you ship.
CORS
CORS with credentials and a wildcard: the worst combination
CORS is supposed to protect your API from other websites. Combine a wildcard origin with credentials and you do the opposite — you invite them in. Here is the fix.
Concepts
What is an attack surface? Your website edition
Your attack surface is simply every way the outside world can reach your site. Understanding it is the first step to shrinking it — here is what counts.
Secrets
How AWS access keys leak — and what attackers do in the first 5 minutes
An AWS access key has a recognizable shape, which makes it easy for bots to spot. Here is where they leak from and what typically happens right after.
Vibe Coding
AI wrote my backend — so who owns the security?
When an AI assistant writes most of your backend, the responsibility question gets blurry. The answer is simpler than it feels — and it is on you, in a good way.
Secrets
The most common way API keys leak from production sites
API keys do not usually leak through clever hacks. They leak because a key meant for the server ends up in code the browser downloads. Here is the pattern, and the fix.