Blog
Notes from the desk.
Notes on websites, security, and what I'm seeing in apps built with AI.
September 19, 2026
Someone Scanned 30,998 Vibe-Coded Apps. Over Half Let Anyone Read the Database.
An August 2026 passive scan of nearly 31,000 live AI-built apps found 57% of Supabase-backed apps allowed unauthenticated table reads. Here's the exact failure pattern, why AI tools keep producing it, and how to check your own app in ten minutes.
- security
- supabase
- vibe-coding
- rls
May 13, 2026
The TanStack Supply Chain Attack Hiding in Your node_modules
Mini Shai-Hulud compromised 169 npm packages including @tanstack/react-router — a package with 12 million weekly downloads. Here's how the attack worked, what it steals, and what to do right now.
- security
- supply-chain
- npm
- tanstack
April 10, 2026
Anthropic's Mythos Just Found Thousands of Zero-Days — Is Your App Next?
Claude Mythos Preview can find, exploit, and chain software vulnerabilities better than almost any human. Here's what that means for your AI-built app and what you can do about it.
- security
- mythos
- anthropic
- ai-security
March 27, 2026
Real Data Breaches Caused by AI-Generated Code — And How to Prevent Them
AI coding tools are fast, but they're causing real security breaches. Here are documented cases of vibe-coded apps leaking user data, exposing API keys, and getting hacked — and what you can do about it.
- security
- vibe-coding
- data-breach
- ai-code
March 25, 2026
Why Your Vibe-Coded App Needs a Code Review
You built something amazing with AI. Now let's make sure it's production-ready, secure, and built to last.
- code-review
- vibe-coding
- ai-development