security5 min read
The TOTP mistakes AI-generated MFA code makes
Rate limiting, replay attacks, secret entropy, and storage: four ways AI-generated TOTP implementations go wrong before you even think about the UI.
News
security4 min read
Session fixation: the auth bug AI code skips every time
AI-generated login flows almost never call req.session.regenerate() after authentication. That single omission enables session fixation attacks.
security4 min read
HSTS mistakes that make your HTTPS migration risky
HTTP Strict Transport Security is one of the most straightforward security headers, and AI-generated configs still get it wrong in ways that range from ineffective to site-breaking.
ops4 min read
Why you should not use floating point for money (and what AI code does instead)
AI-generated payment code reaches for parseFloat almost every time. The edge cases that produces are not theoretical: they show up in real transactions.
security4 min read
Email header injection in AI-generated Node.js mailers
AI-generated contact forms concatenate user input directly into email headers, turning your mail server into a spam relay with a few extra newlines.
security4 min read
HTTP cache poisoning: the unkeyed header problem in AI-generated proxies
How AI-generated Nginx configs and Express proxy setups create cache poisoning vulnerabilities by forwarding headers like X-Forwarded-Host into cached responses.
security5 min read
When the customer sets their own price
AI-assisted checkout code often trusts the price the browser sends, letting users pay whatever they choose. Here is why the pattern keeps appearing and how to fix it before someone exploits it.
security4 min read
HTTP parameter pollution in AI-generated Express.js APIs
Duplicate query string keys silently turn strings into arrays in Express, breaking authentication and validation logic that AI-generated code almost never accounts for.
security4 min read
Overprivileged Kubernetes pods and service accounts: the blast radius of AI-generated configs
AI-generated Kubernetes manifests routinely reproduce permissive defaults from training data, and when attackers compromise a pod running with those configs, the damage can spread across your entire cluster.