AI coding tools generate working WebSocket servers but routinely skip authentication, origin validation, and rate limiting. Here is what those gaps look like and how to close them.
AI-generated configuration examples almost always show verbose or debug logging enabled because that is what works for local development. Copy-pasting that config to production hands attackers stack traces, internal paths, and database queries.
AI-generated apps routinely ship without CSRF protection, leaving state-changing endpoints open to forged requests from malicious sites. Here's what gets missed and how to fix it.
AI coding assistants write fast, but they inherit decades of insecure patterns from their training data. Here is what goes wrong most often and what you can do about it.
Developers following AI-generated setup instructions frequently commit a .env file before adding it to .gitignore. Secret scanning tools routinely find credentials in history months after the fact, long after rotation is easy.
Every npm install is a trust decision you make without reading the fine print. Here is what is actually happening: postinstall scripts, typosquatted package names, and hundreds of transitive dependencies you have never heard of.
Committing a .env file to git is bad. What makes it worse is that deleting the file does not fix it. Here are the three most common ways secrets escape, and what to do when they do.
LLMs frequently produce SQL queries built with string concatenation instead of parameterised queries. Here is why that happens, how to spot it, and why even ORMs are not always a safe exit.
Most solo projects ship with no rate limiting at all. Here is what happens when someone finds your API, and how to fix it in Express, Next.js, and Hono in about ten minutes.