AI Added a Route That Bypasses Auth Middleware
AI registered an endpoint outside the authenticated route group, leaking internal data. The fastest fix: move the route under the authed router and enforce auth at the data layer, not in middleware.
#Security
Articles tagged with #Security
HSTS Preload Stuck: How to Roll Back HTTPS Enforcement
You preloaded your domain, then needed HTTP back. Browsers still force HTTPS. Here's the fastest real fix, the exact removal steps, and the honest timeline.
Claude Code Accidentally Committed a Secret
Claude Code swept your `.env` or API key into a commit. Rotate the key first (always), purge git history second, then block it for good with a deny rule, scanner, and push protection.
Firebase Config Audit Prompts for Rules and Functions
15 copy-ready prompts to audit Firebase Security Rules, indexes, Cloud Functions, Auth, and App Check — updated for 2nd-gen functions (June 2026).
Supabase RLS Policy Review Prompts for Auth and Roles
15 Supabase Row-Level Security review prompts: auth.uid() checks, WITH CHECK coverage, service_role bypass, storage bucket RLS, SECURITY DEFINER, and the (select auth.uid()) perf fix.