Blog
Guides on shipping securely
Specific, practical write-ups on the mistakes that actually show up in AI-generated and fast-shipped apps, not generic security advice.
Aug 26, 2026
What Can a GitHub App Actually Access? A Plain-English Guide
Connecting a GitHub App to your repo is a different (and safer) thing than handing over a personal access token. Here's exactly what it can and can't do.
Aug 26, 2026
The Most Common Security Mistakes in AI-Generated Code
Building fast with an AI coding tool changes what tends to go wrong. Here are the specific mistakes that show up again and again in AI-generated apps, and how to catch them before you ship.
Aug 26, 2026
Is Your Supabase Database Actually Public? How Row Level Security Really Works
Supabase's anon key is meant to be public. Row Level Security is what's supposed to stop that from meaning your whole database is public too, here's how to actually check it.