News

Hardcoded Secrets in the Age of AI Assistants

AI coding assistants make it easy to paste secrets directly into code. That convenience creates real security risks. Here is why and how to stop.

A red padlock resting on a black computer keyboard

security6 min read

Your AI-generated API defaults to Access-Control-Allow-Origin: *

Ask an assistant to "fix the CORS error" and it will reach for the wildcard every time. Here is why that is the wrong fix for anything that reads a cookie or an auth header.

Lines of code and error output displayed on a computer screen

data-exposure4 min read

Your Error Messages Are Oversharing: A Wake-Up Call for AI-Assisted Developers

Verbose error messages leak stack traces, database schemas, and internal paths. Learn why this common oversight is dangerous and how to fix it.

configuration4 min read

Your AI Assistant Won't Save You From Committing Secrets

AI coding assistants make it easy to hardcode API keys. That's a problem. Here's why environment variables still matter and how to fix your setup.

Shipping containers stacked high at a busy port

dependency-hygiene5 min read

Your AI assistant won't tell you about that CVE in your dependencies

AI coding assistants often suggest outdated packages without checking for known CVEs. Here's why that happens and how to catch it before it ships.

A rack of electronic server equipment in a dark room

ops-basics6 min read

Your AI Copilot Left a Map to Your Localhost. Time to Clean Up

Hardcoded localhost and dev URLs are a quiet ops hazard. AI assistants often add them without thought. Here's why they break production and how to fix them.

A red and black vintage alarm clock against a dark background

ops-basics7 min read

Your AI Assistant Just Paved the Road to Nowhere (and a Breach)

AI coders copy localhost and dev URLs into production code, leaking internal services and breaking security. Here is why it happens, what it costs, and how to stop it without slowing down.

Rows of network cables plugged into servers in a dark data centre

resilience5 min read

Your AI Copilot Just Made a 10 MB Mistake

AI coding assistants generate fast code, but they skip request size checks and input validation. Learn why that breaks your API and how to enforce limits cheaply.

A collection of various hand tools laid out on a grey rock surface

security5 min read

Your AI Copilot Is Leaking Your Cloud Keys: Stop Pasting Secrets Into Prompts

AI tools copy hardcoded secrets into code, making leaks worse. Learn to keep credentials out of source and prompts, and rotate them if exposed.