Blog
Notes on shipping secure AI-built apps and provable test coverage.
Coverage tells you which lines ran, not whether your tests would catch a bug. Here is how mutation testing with Stryker measures test quality in JavaScript and TypeScript.
A plain-English guide to checking whether your Firebase Realtime Database or Firestore is readable by anyone, why it happens, and how to lock it down.
A practical guide to turning on Row Level Security in Supabase and writing policies that scope rows to the right user, with copy-paste SQL examples.
You found your Supabase anon key in your app bundle or a public repo. Here is whether that is actually a problem, when it is, and exactly how to check.
A quick, practical checklist to see whether your Replit app is exposing keys, an open database, or private files to anyone who visits.
A quick, practical checklist to see whether your v0 app is exposing keys, an open database, or private files once you wire it to a real backend.
A quick, practical checklist to see whether your Bolt (bolt.new) app is exposing keys, an open database, or private files to anyone who visits.
A quick, practical checklist to see whether your Base44 app is exposing data, keys, or private files to anyone who visits.
A quick, practical checklist to see whether your Lovable app is exposing keys, an open database, or sensitive files to anyone who visits.
A plain-English guide to checking whether your Supabase tables are readable by anyone, why it happens, and how to lock them down with Row Level Security.