Content Security Policy headers are one of the most effective mitigations against cross-site scripting, yet AI assistants almost never add them. This guide explains CSP basics and shows a starter policy for Next.js and Express apps.
AI assistants routinely generate S3 buckets with no public access block, wildcard IAM policies, and no encryption at rest. Here is what gets skipped and how to catch it before it costs you.
AI code generators frequently suggest unsafe deserialization patterns in Node.js, including the node-serialize package and vm module misuse, both of which can lead to remote code execution. Here is what to watch for and how to fix it.
When an AI assistant writes a service client, it connects, fires the request, and returns the response. There is no timeout, no retry budget, and no protection against a slow upstream taking down the rest of your application.
AI-generated API code follows clean, readable patterns that fall apart under concurrent load. Here is how race conditions end up in your endpoints and what to do about it.
GraphQL's introspection feature is useful during development and dangerous in production. Leaving it enabled hands attackers a complete map of your API, including every field, type, and mutation you may have forgotten about.
AI coding tools scaffold apps fast but almost never configure HTTP security headers. Here is what is missing from most generated apps, why it happens, and what to do about it.
Logging middleware generated by AI tools captures full request bodies and headers by default because that is the most useful setting during development. In production, email addresses, tokens, and form data flow straight into your log aggregator.
Dangling CNAME records pointing at deleted services let attackers claim your subdomains and inherit the trust of your domain. Here is what that attack looks like, which platforms expose you most often, and how to find and clean up the records before someone else does.