Practical guides on what AI coding tools leave exposed, how to read a Launch Readiness score, and shipping secure code without a security team.
The 5 leaks in most AI-built apps: keys in the JS bundle, a public .env, an exposed .git folder, source maps, and missing headers. A pre-flight checklist.
A calm, ordered runbook for a leaked OpenAI, Anthropic, Stripe, Supabase, AWS or GitHub key. Rotate first — deleting the code fixes nothing.
The three ways a file full of secrets becomes readable at yoursite.com/.env — git, your deploy, or a public env prefix — and the habits that prevent it.
One Supabase key is publishable; the other bypasses all your security rules. How the mix-up happens in AI-built apps and what to do if the wrong one leaks.
Most scanners take "I'm allowed to test this" on faith — and that faith is how automated testing becomes an incident. A safer alternative, by architecture.
PTaaS gets used for everything from a rebranded scanner to a managed pentest. A clear definition, how it differs from a pentest, and what to look for.
Four families of app security testing, four different blind spots. What each technique catches, what it misses, and why you need all four working together.