Blog Posts
How to Prevent Login Brute Force Attacks
Rate limiting alone won't stop credential stuffing. The layered defense that actually works: progressive delays, MFA on privileged accounts, hardened password reset, and the session controls most AI-built auth skips.
Security Basics
8 min
How to Prevent Login Brute Force Attacks
Learn how to prevent login brute force attacks with rate limits, MFA, safe recovery flows and monitoring that protect SaaS accounts without harming users.
How to Fix Public Supabase Database Access
A public Supabase database is usually RLS disabled, a permissive policy copied from a tutorial, or an endpoint that trusts a user-supplied ID. How to find it, lock it down, and verify the fix holds.
Security Basics
9 min
How to Fix Public Supabase Database Access
Learn how to fix public Supabase database access: contain exposure, enable RLS, tighten grants and verify policies before customer data is exposed online.
Supabase Row Level Security Audit Checklist
RLS enabled doesn't mean your data is protected. The failures that actually expose customer records: disabled tables, write-only gaps, spoofable tenant IDs, and exposed service-role keys.
Security Basics
9 min
Supabase Row Level Security Audit Checklist
A Supabase row level security audit finds exposed data paths, weak policies and service-role misuse before customers, revenue and trust are hit early.
How to Test for IDOR Vulnerabilities Safely
Learn how to test for IDOR vulnerabilities in a live SaaS app, confirm broken object access safely, and apply fixes that protect every customer record.
Security Basics
9 min
How to Test for IDOR Vulnerabilities Safely
A practical, two-account method for testing IDOR (broken object-level authorisation) in AI-built apps, including Supabase RLS checks and how to fix what you find.
How to Safely Remove Secrets From Git History
A deleted .env file isn't gone if it was ever committed. What to rotate first, how to rewrite history safely with git filter-repo, and why the cleanup matters less than the credential rotation.
Security Basics
8 min
How to Safely Remove Secrets From Git History
Learn how to remove secrets from git history, rotate exposed credentials, protect production users and prevent a rushed repository fix becoming a breach.
How to Find Exposed API Keys Before They Cost You
API key leaks rarely come from someone deliberately publishing a secret. They come from rushed deploys, frontend variables, and old commits. Here's where to actually look, and how to triage what you find.
Security Basics
8 min
How to Find Exposed API Keys Before They Cost You
Learn how to find exposed API keys across your code, build output and live app, then revoke, rotate and prevent leaks before attackers can ever use them.
How a Security Audit for AI Generated Code Works
What a real security audit actually examines in an AI-built application, from exposed credentials and broken RLS policies to payment logic that trusts the browser instead of the server.
Security Basics
7 min
How a Security Audit for AI Generated Code Works
A security audit for AI generated code finds exposed keys, broken access control and unsafe payments before a new app puts customers and revenue at risk.
IDOR vulnerabilities: what they are, what they look like, and why they keep showing up in AI-built apps
What IDOR actually means, a concrete example of how it works, why AI-generated code is particularly exposed to it, and how it gets caught during a security audit.
Security Education
6 min
IDOR Vulnerability Explained: What It Is and How It Shows Up in AI-Built Apps
What IDOR actually means, a concrete example of how it works, why AI-generated code is particularly exposed to it, and how it gets caught during a security audit.
What an access control audit actually checks for
What broken access control actually means, what IDOR looks like in a vibe-coded app, and what an access control review checks for. In plain language, no technical background required.
Security Education
8 min
Access Control Audit: What It Checks and Why It Matters for AI-Built Apps
What broken access control actually means, what IDOR looks like in a vibe-coded app, and what an access control review checks for. In plain language, no technical background required.
What I keep finding in Bolt.new apps before they go live
Bolt.new Security: The Most Common Vulnerabilities in Bolt-Built Apps
Security Education
8 min
Bolt.new Security: The Most Common Vulnerabilities in Bolt-Built Apps
The security patterns that come up most consistently in Bolt.new apps: hardcoded API keys, source maps in production, client-side-only auth, missing RLS, and hallucinated packages.
The Supabase security checklist I run before any app goes live
The full Supabase security checklist covering RLS, service_role key exposure, storage permissions, auth configuration, and database functions. Ordered by severity.
Security Education
9 min
Supabase Security Checklist: What to Verify Before Launch
The full Supabase security checklist covering RLS, service_role key exposure, storage permissions, auth configuration, and database functions. Ordered by severity.
Supabase security: everything beyond RLS that still needs your attention
RLS is just one layer. This covers the rest of the Supabase security surface: service_role key exposure, storage bucket permissions, auth configuration, and database function access.
Security Education
8 min
Supabase Security: Storage, Auth, API Keys and What RLS Doesn't Cover
RLS is just one layer. This covers the rest of the Supabase security surface: service_role key exposure, storage bucket permissions, auth configuration, and database function access.
API key security: what actually happens when your credentials are exposed
What API keys are, how they leak, what the automated attack chain looks like, and what proper credential handling actually looks like for founders building with AI tools.
Security Education
9 min
API Key Security: How Credentials Get Exposed and What To Do About It
What API keys are, how they leak, what the automated attack chain looks like, and what proper credential handling actually looks like for founders building with AI tools.
Security headers: what they actually are, which ones matter, and what happens when they're missing
What security headers are, which ones matter most, and what actually happens when they're missing from your AI-built app. No technical background required.
Security Education
8 min
Security Headers Explained: CSP, HSTS, X-Frame-Options and Permissions-Policy
What security headers are, which ones matter most, and what actually happens when they're missing from your AI-built app. No technical background required.
Security Resources for AI Founders: The Essential Reading List
A curated list of free security tools and research every AI founder should know before launch. From OWASP LLM Top 10 to live scanning tools, no technical background required.
Security Education
7 min
Security Resources for AI Founders (2026 Reading List)
The security resources HollowByte sends founders building with Lovable, Bolt, and Cursor: OWASP LLM Top 10, free scanning tools, and what to check before launch.
What Actually Happens When Your Supabase RLS Is Misconfigured
83% of Supabase database exposures trace back to disabled Row Level Security. Here's what an unprotected table actually looks like to an attacker, including the Moltbook breach and CVE-2025-48757, plus a 30-second way to check your own app.
Security
6 min
What Actually Happens When Your Supabase RLS Is…
83% of Supabase database exposures trace back to disabled Row Level Security. Here's what an unprotected table actually looks like to an attacker, including…
5 Things Your AI Generated Code Will Never Tell You About Itself
AI coding tools ship you speed and confidence, but the research shows 45% of AI generated code introduces OWASP Top 10 vulnerabilities, developers trust it more while it's measurably less secure, and the flaws are often structural.
Security
6 min
5 Things Your AI Generated Code Will Never Tell You…
AI coding tools ship you speed and confidence, but the research shows 45% of AI generated code introduces OWASP Top 10 vulnerabilities, developers trust it…
Lovable Apps Have a Security Problem Nobody's Talking About
I audited 8 Lovable apps in one week, and every single one had at least one high severity finding.
Lovable Application Security
4 min
Lovable Apps Have a Security Problem Nobody's Talking…
I audited 8 Lovable apps in one week, and every single one had at least one high severity finding.
The 30 minute security checklist I run on every AI built app before it goes live
I have been auditing apps built with AI tools such as Cursor/Bolt/Lovable for quite some time now, and I have always noticed that the same security issues keep coming up in various different domains.
AI security checklist
6 min
30-Min AI App Security Audit Checklist
Run a 30-minute app security audit before launch: check headers, SSL, exposed secrets, localStorage tokens, network calls, auth rate limits, and reset flows.
Cybersecurity Fundamentals Every AI Founder Should Know Before Launch
From what I’ve personally observed, most AI founders seem technical enough to bring their software products to life, but not quite technical enough to know what they are actually exposing when they use AI tools to build and ship quickly.
AI founder security
8 min
Cybersecurity Basics for AI Founders
Learn the app security fundamentals AI founders need before launch, from prompt injection and exposed secrets to agent permissions and adversarial testing.