Articles
Security guides for people who ship SaaS
Practical checks you can run on your own app: Supabase and Firebase rules, headers, secrets in bundles, email authentication, deploy settings. Every number links to its source.
Does .cursorignore protect your .env file? What Cursor actually blocks
What .cursorignore blocks in Cursor (Agent, Tab, @ mentions), why the agent's terminal can still read your .env file, and how to keep real keys out of reach.
Docker bypasses ufw: why published ports stay open, and how to close them
Why ports published with Docker ignore ufw and firewalld, how to see what is reachable from outside, and three fixes taken from Docker's own documentation.
Docker secrets in image layers: why deleting .env doesn't remove it
How .env files, ARG and ENV values end up inside Docker image layers, the commands to find them in your own image, and the BuildKit and Compose fixes.
Firebase security rules after test mode: why auth != null isn't enough
Test mode expired or about to? Why "request.auth != null" still exposes every user's data, an owner-only Firestore rule, and how to test it before deploying.
Subresource integrity after polyfill.io: what SRI stops and what it can't
How subresource integrity works, why it couldn't have protected sites from the polyfill.io attack, and the self-hosting and CSP setup that does.
How to check your Supabase row level security like an attacker would
A four-step test for Supabase row level security: RLS on every table, no blanket policies, a request as a stranger, and rotating anything exposed.