dependency-hygiene5 min read
Your AI assistant won't tell you about that CVE in your dependencies
AI coding assistants often suggest outdated packages without checking for known CVEs. Here's why that happens and how to catch it before it ships.
News
ops-basics6 min read
Your AI Copilot Left a Map to Your Localhost. Time to Clean Up
Hardcoded localhost and dev URLs are a quiet ops hazard. AI assistants often add them without thought. Here's why they break production and how to fix them.
ops-basics7 min read
Your AI Assistant Just Paved the Road to Nowhere (and a Breach)
AI coders copy localhost and dev URLs into production code, leaking internal services and breaking security. Here is why it happens, what it costs, and how to stop it without slowing down.
resilience5 min read
Your AI Copilot Just Made a 10 MB Mistake
AI coding assistants generate fast code, but they skip request size checks and input validation. Learn why that breaks your API and how to enforce limits cheaply.
security5 min read
Your AI Copilot Is Leaking Your Cloud Keys: Stop Pasting Secrets Into Prompts
AI tools copy hardcoded secrets into code, making leaks worse. Learn to keep credentials out of source and prompts, and rotate them if exposed.
resilience3 min read
The list endpoint that fetches every row works fine, until the table grows
A list endpoint with no LIMIT clause is correct at ten test rows and a resource exhaustion risk at production scale, and no small dataset will ever catch the difference.
security3 min read
A deep merge helper with no key check is a prototype pollution bug
A recursive object merge that copies every key from user input, including __proto__, can rewrite the default properties of every plain object in the running process.
security3 min read
Deleting a committed .env file doesn't remove it from git history
A follow-up commit that removes .env from the working tree leaves the original commit, and every secret in it, fully readable in the repository's history.
security3 min read
The post-login redirect nobody checks is a phishing tool waiting to happen
Redirecting to a next query parameter after login without validating it against your own host turns a trusted login page into a launchpad for phishing links.