track: ship safely

4 articles · newest first

Flat illustration of a browser window with a hidden compartment showing a key, while a person moves a key into a safe

Your API keys are in the browser: which ones matter and the fix

Whatever your app sends to the browser, anyone can read. Which keys are designed to be public, which must never be, how secrets end up there, and the server-function fix, from each vendor's own docs.

Sam Ortega · 44m ago · 7 min

Flat illustration of two people each looking through their own window at a table, each seeing only their own coloured rows

Build

Row Level Security explained (with a picture): the setting that matters

The one database setting behind the biggest vibe-coded app exposures, shown as a table: who sees what with RLS off, who sees what with it on, and the policy your AI tool should be writing.

Sam Ortega · 44m ago · 7 min

Flat illustration of an open database cylinder with envelopes and keys floating out while a person fits a padlock

Build

The Moltbook breach: what a public Supabase key without RLS grants

An AI-built social network left its whole database readable and writable. The key wasn't stolen; one setting was missing. What happened, from Wiz's write-up, and the lesson for anyone building on Supabase.

Sam Ortega · 44m ago · 7 min

Flat illustration of a person with a clipboard checking padlock and shield icons around a laptop

Build

Before you share your vibe-coded app: the 6 security checks

The six mistakes behind 2026's vibe-coded app exposures, turned into checks you can do without reading code: RLS, secrets, server-side auth, admin, webhooks and rate limits.

Sam Ortega · 44m ago · 8 min