Vibe coding security best practices and AI tool privacy
Review AI code, keep API keys server-side, use proven auth and check your AI tool's privacy policy. Plus lessons from a Lovable app that exposed 18,697 records.
BattleTester Blog
What OWASP guidance says about CORS misconfiguration
OWASP's testing guide calls permissive CORS very insecure except for public APIs. See how to test for it, the CWE-942 mapping, real cases and the fixes.
Does Replit have a built-in security scanner?
Yes. Paid Replit builders get an Agent security scan of their code. Replit itself says it is not a complete security review. Here is what it checks and what it misses.
Which security headers extension to use, and what it misses
Three security headers extensions compared on what they check and how. Also: why 2,485 Chrome extensions were found altering security headers.
Security headers meaning: what they are and why they matter
Security headers are HTTP response headers that tell browsers how to handle your site. See the core list, what each blocks, and how to check yours for free.
The Replit security checklist to run before you ship
Replit handles HTTPS and secret storage, but your auth, access control and business logic are on you. A pre-launch checklist that also covers the gaps.
Security headers for APIs: what to set and test
The 6 security headers a JSON API should send, which ones only matter for HTML, and what a security headers check can never tell you.
What the Replit Security Agent covers and what it leaves to you
Replit is SOC 2 Type II certified, but its docs say a security scan is not a complete review. What Replit secures, what you own, and a pre-launch checklist.
How to set up security headers in a web application
Six HTTP security headers to set, three deprecated ones to drop, safe starting values, how to check them for free, and what a header check cannot see.
What a CORS misconfiguration vulnerability actually allows attackers to do
A CORS misconfiguration lets an attacker's page read responses through a victim's browser. See the 3 patterns, a real CVE, and why CWE labels differ.
Replit security breach: what actually happened in 2023 and 2025
The "Replit breach" is 2 separate events: a 2023 GitHub token exposure and a 2025 AI agent that wiped data. See what Replit covers and what you must test.
How a CORS misconfiguration CVSS score is decided
No fixed CVSS score exists for a CORS misconfiguration. See how credentials, Scope and Confidentiality in CVSS 3.1 move one finding from Medium to High.