Topics
Browse by tool and failure mode.
agent
Agents SDK
AGENTS.md
auth
- Claude Code checked user_metadata.role — clients can set admin
- Lovable deploy went green — auth still pointed at localhost
- Cursor auth worked in dev, dead in prod (hardcoded env)
- Bolt.new launch night: RLS and Stripe webhook gaps
- Paying vibe SaaS with open RLS and dead email verify
Bolt
- Service-role key shipped in the browser bundle
- Stripe Edge webhook returned 401 — verify_jwt blocked Stripe
- Bolt export hit the Stripe wall — preview is not production
- Bolt.new launch night: RLS and Stripe webhook gaps
- Same invoice-app spec: Lovable, Bolt, Cursor — three security profiles
Claude
Claude Code
- Planted AGENTS.md in Downloads turned Codex into malware install
- Agents SDK burned the Claude Code 5-hour bar faster than the CLI
- Claude Code: one research prompt burned the usage window in ~10 min
- Claude Code claude -p: project MCPs start without asking
- LiteLLM 1.107.0 stole keys — GH CLI OAuth showed up in agent logs
- Claude Code checked user_metadata.role — clients can set admin
- Max plan burned in ~3 heavy days — agents and plugins ate the window
- Claude Code Stripe webhook without signature verification
- Checkout refresh loop burned Claude Code API spend
- Two Markdown files that stop Cursor and Claude agent amnesia
Codex
context-drift
- Cursor context drift reverted OAuth back to API keys
- Two Markdown files that stop Cursor and Claude agent amnesia
Cursor
- Stripe invoice.payment_failed logged — access never revoked
- USING (true) RLS leaked the whole users table
- Cursor agent ran git restore and wiped uncommitted work
- Seven critical security leaks that keep showing up in AI apps
- Cursor free-iterate wrecked a finished Expo game
- Cursor auth worked in dev, dead in prod (hardcoded env)
- Cursor context drift reverted OAuth back to API keys
- Stripe webhook returns 200 but never updates the database
- Same invoice-app spec: Lovable, Bolt, Cursor — three security profiles
- Two Markdown files that stop Cursor and Claude agent amnesia
deploy
- Lovable deploy went green — auth still pointed at localhost
- Stripe Edge webhook returned 401 — verify_jwt blocked Stripe
- Bolt export hit the Stripe wall — preview is not production
- Cursor free-iterate wrecked a finished Expo game
- Checkout refresh loop burned Claude Code API spend
env
Expo
game
git
LiteLLM
Lovable
- Stripe invoice.payment_failed logged — access never revoked
- USING (true) RLS leaked the whole users table
- Service-role key shipped in the browser bundle
- Lovable deploy went green — auth still pointed at localhost
- Stripe webhook returns 200 but never updates the database
- Same invoice-app spec: Lovable, Bolt, Cursor — three security profiles
- Paying vibe SaaS with open RLS and dead email verify
MCP
- Planted AGENTS.md in Downloads turned Codex into malware install
- Claude Code claude -p: project MCPs start without asking
OAuth
payments
- Stripe invoice.payment_failed logged — access never revoked
- Bolt export hit the Stripe wall — preview is not production
- Stripe webhook returns 200 but never updates the database
- Checkout refresh loop burned Claude Code API spend
process
- Agents SDK burned the Claude Code 5-hour bar faster than the CLI
- Claude Code: one research prompt burned the usage window in ~10 min
- Claude Code claude -p: project MCPs start without asking
- Cursor agent ran git restore and wiped uncommitted work
- Max plan burned in ~3 heavy days — agents and plugins ate the window
- Two Markdown files that stop Cursor and Claude agent amnesia
prod
rate-limit
RLS
- USING (true) RLS leaked the whole users table
- Seven critical security leaks that keep showing up in AI apps
- Bolt.new launch night: RLS and Stripe webhook gaps
- Same invoice-app spec: Lovable, Bolt, Cursor — three security profiles
- Paying vibe SaaS with open RLS and dead email verify
scope-creep
secrets
- Claude Code claude -p: project MCPs start without asking
- LiteLLM 1.107.0 stole keys — GH CLI OAuth showed up in agent logs
- Service-role key shipped in the browser bundle
- Seven critical security leaks that keep showing up in AI apps
security
- Planted AGENTS.md in Downloads turned Codex into malware install
- Claude Code claude -p: project MCPs start without asking
- LiteLLM 1.107.0 stole keys — GH CLI OAuth showed up in agent logs
- USING (true) RLS leaked the whole users table
- Service-role key shipped in the browser bundle
- Claude Code checked user_metadata.role — clients can set admin
- Seven critical security leaks that keep showing up in AI apps
- Same invoice-app spec: Lovable, Bolt, Cursor — three security profiles
- Claude Code Stripe webhook without signature verification
spend
- Agents SDK burned the Claude Code 5-hour bar faster than the CLI
- Claude Code: one research prompt burned the usage window in ~10 min
- Max plan burned in ~3 heavy days — agents and plugins ate the window
Stripe
- Stripe invoice.payment_failed logged — access never revoked
- Lovable deploy went green — auth still pointed at localhost
- Stripe Edge webhook returned 401 — verify_jwt blocked Stripe
- Bolt export hit the Stripe wall — preview is not production
- Stripe webhook returns 200 but never updates the database
- Bolt.new launch night: RLS and Stripe webhook gaps
- Claude Code Stripe webhook without signature verification
- Paying vibe SaaS with open RLS and dead email verify
subagents
Supabase
- USING (true) RLS leaked the whole users table
- Service-role key shipped in the browser bundle
- Claude Code checked user_metadata.role — clients can set admin
- Lovable deploy went green — auth still pointed at localhost
- Stripe Edge webhook returned 401 — verify_jwt blocked Stripe
- Bolt.new launch night: RLS and Stripe webhook gaps
supply-chain
tokens
- Agents SDK burned the Claude Code 5-hour bar faster than the CLI
- Claude Code: one research prompt burned the usage window in ~10 min
- Max plan burned in ~3 heavy days — agents and plugins ate the window