Practical writing on auditing, hardening, and the failure modes of vibe-coded apps.
What moves the price, the typical fixed-price bands, and how to keep your own quote down.
July 16, 2026 · 7 min read
AI-generated code often puts the provider API key where the browser can read it. A free scanner catches it before it reaches production.
June 28, 2026 · 8 min read
Your prompts carry runtime data. A card number or API key can travel to OpenAI inside one. Scan, redact, and block leaks at the HTTP layer.
June 28, 2026 · 7 min read
A rate limiter watches the front door. Your agent loop is in the back room. A circuit breaker watches the actual provider traffic.
June 28, 2026 · 7 min read
When you call OpenAI, personal data goes to their subprocessors too. Generate an Article 30 record from your real AI traffic.
June 28, 2026 · 6 min read
An open-source package I built to catch secrets and PII before your app emails them out.
June 25, 2026 · 7 min read
The handful of flaws that show up again and again when an assistant writes the controllers.
June 10, 2026 · 6 min read
A practical checklist for founders who shipped fast and want to sleep at night.
June 3, 2026 · 6 min read
Where common Laravel mistakes land on the OWASP list, and how to close them.
May 27, 2026 · 7 min read
Debug, secrets, sessions, cookies, and the settings that quietly leak.
May 20, 2026 · 6 min read
Why $request->all() is the most expensive shortcut in Laravel.
May 12, 2026 · 5 min read
String-built SQL is a favourite of code assistants. Here is the safe pattern.
May 5, 2026 · 5 min read