Insights
Practical guides on AI coding agents, LLM costs, websites and custom software: what we built, what it cost and what we would do differently.
Articles tagged Security
Most leaked credentials were never hidden well: they were committed, pasted, logged or shipped to the browser. The practical rules that keep them out, and how to rotate one that got through.
A database that works on your laptop can be reachable by anyone once the project is public. The Supabase linter flags the tables, policies and keys that let that happen.
In Supabase the database is reachable through an API, so row-level security is the access control. Here is what it does, the mistake that exposes a table, and how to test a policy as anon and as a signed-in user.
An autonomous security agent is an architecture problem before it is a model problem. Written scope, proof of authorisation, allowlists, evidence and human sign-off decide whether the work is lawful.
Every business that adds a chatbot or an agent now owns an input-validation problem it did not have. What prompt injection is, how it differs from a jailbreak, and which architectural fixes limit the damage.
Security reading lists rot faster than any other kind. We publish the method we use to judge, prune and date one, plus fifteen entries checked in October 2026.
You do not need a bug bounty to hear about a bug before the internet does. One page, one security.txt, a response window and a safe-harbour sentence cover most of it.
A shared browser profile puts every client session in one cookie jar, under extensions that can read them all. Here is what a stolen session grants, and what real isolation means.
Zero data retention means a provider stores neither your prompt nor the answer. Through a router the promise must hold at every hop. Here is what OpenRouter, OpenCode and Command Code document as of 4 October 2026.
On personal plans, ChatGPT may train on your chats unless you opt out. Compare ChatGPT, Gemini, Claude, Copilot and others: training defaults, opt-outs, temporary chats and retention, checked 4 October 2026.
Cybersecurity for small business starts with ten habits: unique passwords, 2FA, payment checks, updates, tested 3-2-1 backups and an incident plan. Checklist and Romanian contacts included.
Give every Vercel, Netlify, Cloudflare, Supabase or Gmail account its own isolated browser session and you can switch without logging out. Here are the options, the security trade-offs and the rules to check.
Embedding a client's live site in your portfolio is a great demo, until X-Frame-Options or a Content-Security-Policy quietly blanks the frame. A practical guide.
