Seven critical security leaks that keep showing up in AI apps
- Tried
- Ship vibe-coded SaaS fast, then look back at what security reviews kept finding
- Broke
- Recurring: USING (true), hardcoded service_role, wild CORS, unvalidated webhooks, secrets in comments/.env.example patterns
- Fix
- Run a dedicated security pass with a written checklist before first paid user; fix RLS and secrets first