guides

Everything we've written down

New here? Start with the checklist. The rest is sorted by what you'd search for: an idea, a key, your platform or your host. Looking for how to fix one specific finding? That's /fix.

start hereVibe coding security: the complete checklistSecuring an app built with an AI agent means checking the parts you never see while clicking around it: secret keys kept on the server, database access rules switched on, logins enforced on the server, security headers set and no private files published. The checklist at the end of this page covers each one in the order worth doing them.toolSecurity headers checkerEnter your URL above to check the security headers your live site sends: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options and Referrer-Policy. You get a grade from A to F, and every missing or weak header comes with the config for your host and a command to confirm the fix.

Learn

/learn →

The ideas behind the most common gaps, explained once, properly, with what to tell your agent.

API keys

/keys →

Some keys are meant to sit in your front end. Others hand over your account. Each guide shows what the key looks like, whether it is safe to expose, and what to do if it leaked.

Platforms

/check →

The platforms are usually solid. The app you built on top of them is a separate question. Pick yours to see what apps on that stack tend to miss, where the fix goes, and how to check your live site.

Security headers

/headers →

Every host sets response headers in a different place. Pick yours for a config block you can paste, then check the result on your live site.