Security notes for people who ship fast.

What we check, why a mistake keeps happening, and the decisions behind how the report is written. No listicles.

LatestOpinionJul 24, 20267 min read

A green tick is not an answer

Most scanners give you two states, and a pass can mean either “we looked and it was fine” or “we never looked”. Here is why we split them, and what it changed about the score.

Read it

Everything else

Jul 17, 2026

Deleting a key does not delete a key

You removed the API key and pushed. It is still in your history, still readable by anyone who cloned the repo, and still valid until you rotate it. What to do in what order.

Security basics

5 min

Jul 9, 2026

Row-level security is where vibe-coded apps leak

The pattern we see most: the frontend checks who you are, the database does not. Anyone with the anon key can read the whole table. How to tell whether yours does.

Rule pack

6 min

Jun 30, 2026

Why we cut the network in the middle of a scan

Your code is cloned with the network on, then egress is cut and verified with a canary before a single scanner runs. If the cut cannot be proved, the scan aborts and the credit goes back.

How it works

8 min

Jun 21, 2026

The admin route nobody checks

Signed in is not the same as allowed. The most common high-severity finding we write rules for is an admin page that only checks whether you have an account.

Security basics

4 min

Jun 12, 2026

What a score out of 100 can honestly mean

A single number hides things. Ours states what it is made of, drops to a partial result when a stage fails, and refuses to produce a score at all when it cannot stand behind one.

How it works

6 min

Or find out what yours says.

Reading about it is slower than running it. Two scans a day on the free plan, no card.

Book a demo See what shipped