SECURITY BLOG
Practical security, in plain language.
Guides to the problems we look for in websites and code: exposed secrets, missing protections, risky patterns in AI-written code, and how to fix them.
AI-WRITTEN CODE
Five security mistakes that are common in AI-written code
AI assistants write working code fast, but working is not the same as safe. Five common mistakes, how to spot them in your own code and how to fix each one.
EXPOSED SECRETS
You pushed an API key to GitHub. What to do in the next hour
A step-by-step plan for a leaked key: revoke it first, check whether it was used, clean the repository and stop it happening again.
WEBSITE SECURITY
Security headers explained: what each one does and how to add it
Six response headers that protect your visitors, what each one does, and copy-ready settings for Nginx, Apache and Node.js.
WEBSITE SECURITY
Is your .env file public? How to check in two minutes
How to check whether your .env file, .git folder or backups can be downloaded from your website, how to block them and what to do if they were exposed.
SECURITY BASICS
What an automated security scan can and cannot tell you
Scans are fast and useful, and easy to misread. What they catch, what they miss, and how they compare with a reviewed assessment and a penetration test.