Vibe coding security best practices and AI tool privacy
Review AI code, keep API keys server-side, use proven auth and check your AI tool's privacy policy. Plus lessons from a Lovable app that exposed 18,697 records.
Posts by Yovel Ovadia
What OWASP guidance says about CORS misconfiguration
OWASP's testing guide calls permissive CORS very insecure except for public APIs. See how to test for it, the CWE-942 mapping, real cases and the fixes.
Does Replit have a built-in security scanner?
Yes. Paid Replit builders get an Agent security scan of their code. Replit itself says it is not a complete security review. Here is what it checks and what it misses.
Which security headers extension to use, and what it misses
Three security headers extensions compared on what they check and how. Also: why 2,485 Chrome extensions were found altering security headers.
Security headers meaning: what they are and why they matter
Security headers are HTTP response headers that tell browsers how to handle your site. See the core list, what each blocks, and how to check yours for free.
The Replit security checklist to run before you ship
Replit handles HTTPS and secret storage, but your auth, access control and business logic are on you. A pre-launch checklist that also covers the gaps.
Security headers for APIs: what to set and test
The 6 security headers a JSON API should send, which ones only matter for HTML, and what a security headers check can never tell you.
What the Replit Security Agent covers and what it leaves to you
Replit is SOC 2 Type II certified, but its docs say a security scan is not a complete review. What Replit secures, what you own, and a pre-launch checklist.
How to set up security headers in a web application
Six HTTP security headers to set, three deprecated ones to drop, safe starting values, how to check them for free, and what a header check cannot see.
What a CORS misconfiguration vulnerability actually allows attackers to do
A CORS misconfiguration lets an attacker's page read responses through a victim's browser. See the 3 patterns, a real CVE, and why CWE labels differ.
Replit security breach: what actually happened in 2023 and 2025
The "Replit breach" is 2 separate events: a 2023 GitHub token exposure and a 2025 AI agent that wiped data. See what Replit covers and what you must test.
How a CORS misconfiguration CVSS score is decided
No fixed CVSS score exists for a CORS misconfiguration. See how credentials, Scope and Confidentiality in CVSS 3.1 move one finding from Medium to High.
What a security headers check tells you and what it misses
A security headers check reads your live response for HSTS, CSP and 3 other headers. Learn how to read the result and what a clean grade leaves untested.
CORS misconfiguration mitigation: fixes for each common mistake
Fix the 4 common CORS mistakes: wildcard with credentials, reflected Origin, allow-all shortcuts and internal wildcards. Then verify the headers changed.
How to check for CORS misconfiguration on your own site
Send a request with a foreign Origin header and read 2 response headers. See which CORS responses are dangerous, how to rate them (CWE-942) and how to fix them.