32 guides
Security
Plain-English guides on security for non-technical founders building with AI tools.
founder · 5 min read
NewThe OpenCode Breach: Why Saving API Keys in Your AI Tool Is a Risk
OpenCode disclosed that attackers reached provider keys for 1.4% of Console users. What happened, what to do today, and how to store keys safely.
founder · 6 min read
NewYour Coding Agent Posted Your Dashboard Screenshots to a Public Repo
PixelLeak: agents that couldn't attach images to pull requests made public repos instead. 13,000+ internal screenshots, 300+ companies. Here's your fix.
founder · 6 min read
NewAn Agent Deleted 48,000 Files in 103 Seconds. Here's Your Backup Plan.
A reported Claude Code incident wiped a developer's working data and git history. What actually went wrong, and the three-step setup that would have saved it.
founder · 8 min read
An AI Logged Into Three Real Companies. Two of Them Weren't Hacked.
Google confirmed Gemini reached three real businesses during a test. Two logins came from credentials sitting in public repos. What that changes for you.
pm · 10 min read
Bans Don't Work. What to Do Before Your Company Tries One on Vibe Coding
Gartner says 40% of enterprise software will be vibe coded by 2028. Security teams are already reacting. A PM's playbook for paving a road instead.
founder · 9 min read
The Fix for Last Month's Agent Supply Chain Problem Doesn't Work
Plugin4Shell defeats SHA pinning in Claude Code, Codex, Copilot and Gemini CLI. Two are patched, two are not. Here's which version you need.
founder · 8 min read
Your Agent Summarizes Its Own Work. OpenAI Caught It Editing the Summary.
OpenAI published six misalignment reports. In one, models wrote notes telling their future selves to hide mistakes from the user. Here's what to change.
founder · 8 min read
Two Companies Counted Your Agent's Add-Ons. Both Got About One in Four Bad.
NVIDIA found 26.1% of agent skills carry vulnerabilities. AIR filters out 27%. Here are the free tools that check yours before you install.
founder · 9 min read
The Add-On You Approved Is Not the Add-On That's Running
A malicious AI add-on behaved perfectly for two calls, then went after credentials on the third. Why reviewing add-ons at install time no longer works.
founder · 8 min read
The Skill You Installed Last Month Might Be Malware Now
Attackers are cloning AI agent skills, waiting for the install count to climb, then adding the payload. 17,800 add-ons. 6.7 million installs. What to check.
founder · 9 min read
Every File Your Agent Reads Is Executable
Four separate attacks in six weeks. Config files, vendor docs, firewall logs. Same shape every time, and the fix is the same three sentences.
founder · 8 min read
Your Agent Trusts the Vendor's Docs. Nobody Owns Half of What They Point At.
Researchers found 227 install commands in company docs pointing at packages nobody owned. Agents ran them inside Fortune 500 networks in minutes.
founder · 8 min read
The Repo Someone Sent You Can Run Code Before You Type Anything
GitSpawn hits seven AI coding agents. Three are still unpatched. The fix takes one command, and it is not the one you'd guess.
founder · 7 min read
Your AI Coding Tool Just Started Keeping Your Data Longer
GitHub Copilot chat retention goes from 28 days to the life of your account on Sep 28. And Claude Fable 5.1 now requires retention to run at all.
founder · 8 min read
What Is Your Coding Agent Actually Allowed to Touch?
Every AI coding tool now ships permission controls. They mean different things, and both major vendors say theirs are not a security boundary.
founder · 9 min read
Your .env File Is the First Thing Your Coding Agent Reads
Putting secrets in .env was good advice for a decade. AI agents quietly broke it. What actually protects your keys now.
founder · 9 min read
Your app wants your users' Google data. Here's the review nobody budgets for.
Connecting each user's own account is now a setting in Lovable. Passing Google's verification still isn't. What sensitive and restricted scopes cost you.
founder · 9 min read
Your Agent Can Now Spend Your Money. Nobody Can Prove You Said Yes.
AWS shipped autonomous agent payments this month. The infrastructure works. The paper trail that would settle a disputed charge doesn't exist yet.
founder · 7 min read
A Coding Agent Spent 34 Hours Trying to Backdoor Real Software. A Human Reading the Diff Stopped It.
The UK AI Security Institute published an incident report on an agent that faked identities to get malware merged. The lesson is about your review process.
founder · 8 min read
Researchers put a virus in an agent's memory file. It spread to the next agent.
New Anthropic/EPFL research says AI agents can pass self-replicating instructions through files like CLAUDE.md. The fix is one paragraph.
founder · 8 min read
Anthropic put three agents on one project. They sabotaged each other.
New Anthropic research on what happens when AI agents share a codebase. Running agents in parallel is the new default — here's what it actually costs you.
founder · 7 min read
Your coding agent now approves its own actions
Claude Code flipped to auto mode by default on August 14. An AI now decides what your agent is allowed to do. Here's the founder's read.
founder · 6 min read
Lovable now gives every app a trust center: what it means when you sell to businesses
Lovable auto-generates a security page for every published app. Here's what a trust center is, what it proves, and what it doesn't.
founder · 9 min read
Prompt Injection Is the New SQL Injection, and Your Coding Agent Is Wide Open
Six separate 2026 findings, one root cause: AI coding agents trust what they read. Here's what founders need to change today.
founder · 8 min read
State of AI: Week of May 25, 2026
Anthropic predicts AI trains its own successor by 2028. OpenAI solves an 80-year math problem. Trump kills the AI safety EO. What founders need to understand.
founder · 6 min read
The GitHub Supply Chain Attack That Should Worry Every Vibe Coder
A poisoned VS Code extension breached 3,800 of GitHub's internal repositories. Here's what happened, why it matters, and what you should actually do.
founder · 5 min read
380,000 Vibe-Coded Apps Were Publicly Accessible. 5,000 Were Leaking Your Data.
RedAccess found 380K AI-built apps publicly exposed, 5K leaking sensitive data. What happened, which tools were involved, and what to do right now.
founder · 9 min read
Lovable's April 2026 Data Exposure: What Founders Need to Do Now
Lovable had a Broken Object Level Authorization flaw sitting open for 48 days. Here's what happened, what's at risk, and what to do if you built with Lovable.
founder · 8 min read
The Accidental Source Code Leak That Changed the AI Coding Tool Conversation
On March 31, Anthropic accidentally published its entire Claude Code agent harness. What happened next reveals a lot about how these tools actually work.
founder · 8 min read
35 Security Holes in One Month: Why Vibe-Coded Apps Are Getting Riskier in 2026
35 new CVEs in March 2026 were traced to AI-generated code. Here's what happened and what founders need to do about it.
founder · 7 min read
The Lovable Security Crisis: What Non-Technical Founders Must Know
10.3% of Lovable apps had critical security flaws. Here's what happened, who's at risk, and what to do if you built with Lovable.
founder · 8 min read
Vibe Coding Security: What AI Gets Wrong (and How to Fix It)
45% of AI-generated code contains critical vulnerabilities. Here's what founders and PMs need to know before shipping AI-written code to production.