configuration4 min read
Your AI Assistant Is Great at Code. It's Terrible at Keeping Secrets.
Developers using AI coding assistants often let hardcoded API keys slip into source code. Here's why that's bad and how to fix it.
News
dependency-hygiene4 min read
The CVE You Never Read: Why AI Code Assistants Keep Shipping Known Vulnerabilities
AI coding assistants are great at generating code, but they often pull in outdated dependencies with known CVEs. Here's how to fix your dependency hygiene.
resilience5 min read
Your AI assistant won't remind you to validate inputs: here's why that hurts
Developers using AI coding assistants often skip basic input validation and request size limits. That oversight turns small bugs into big outages.
security5 min read
Hardcoded Secrets in the Age of AI Assistants
AI coding assistants make it easy to paste secrets directly into code. That convenience creates real security risks. Here is why and how to stop.
security6 min read
Your AI-generated API defaults to Access-Control-Allow-Origin: *
Ask an assistant to "fix the CORS error" and it will reach for the wildcard every time. Here is why that is the wrong fix for anything that reads a cookie or an auth header.
data-exposure4 min read
Your Error Messages Are Oversharing: A Wake-Up Call for AI-Assisted Developers
Verbose error messages leak stack traces, database schemas, and internal paths. Learn why this common oversight is dangerous and how to fix it.
configuration4 min read
Your AI Assistant Won't Save You From Committing Secrets
AI coding assistants make it easy to hardcode API keys. That's a problem. Here's why environment variables still matter and how to fix your setup.
dependency-hygiene5 min read
Your AI assistant won't tell you about that CVE in your dependencies
AI coding assistants often suggest outdated packages without checking for known CVEs. Here's why that happens and how to catch it before it ships.
ops-basics6 min read
Your AI Copilot Left a Map to Your Localhost. Time to Clean Up
Hardcoded localhost and dev URLs are a quiet ops hazard. AI assistants often add them without thought. Here's why they break production and how to fix them.