Web security, explained.
Practical, plain-English guides to the issues that actually get sites breached — and how to fix them.
The OWASP Top 10:2025, and Where Safeey Has You Covered
The OWASP Top 10:2025 is out — the first update since 2021. Here’s every category, what changed, and an honest map of which ones Safeey and safeey-cli automate for you (and which still need a human).
Built an App with Lovable, v0, or Bolt? Scan It Before You Ship
AI app builders ship full-stack apps in minutes — often with backends left open, hardcoded keys, and missing headers. You don’t need any integration to check: scan the live URL with Safeey and the exported code with safeey-cli. Here’s how.
Claude Code + safeey-cli: Catch Vulnerabilities Before You Ship
Wire safeey-cli into Claude Code so it catches and fixes vulnerabilities automatically. Three setups, from a CLAUDE.md line to a Stop hook that won’t let Claude finish until the code is secure.
The 45% Problem: Why Nearly Half of AI-Generated Code Is Vulnerable
Research finds that roughly 45% of AI-generated code contains a security flaw. Here’s why the number is so high, the vulnerabilities behind it — including “slopsquatting” — and how to bring the risk down with safeey-cli.
AI Wrote Your Code. Have You Checked It for Vulnerabilities?
Vibe coding ships working apps in minutes — but "working" isn’t "secure." Here’s what AI-generated code gets wrong, why you can’t eyeball it, and how safeey-cli verifies how risky your code really is.
Scan Your Code in Seconds: A Hands-On Guide to safeey-cli
Meet safeey-cli — a free, local command-line scanner that finds injection flaws, hardcoded secrets, and vulnerable dependencies in your code before you ship. A hands-on walkthrough, with real output.
The CORS Setting That Quietly Leaks Your Users' Private Data
"Access-Control-Allow-Origin: *" is one of the most common — and most misunderstood — security mistakes on the web. Here's what CORS actually does, why one wildcard can expose your users' data, and how to get it right.
Cross-Site Scripting: How One Input Box Can Hijack Your Users
XSS is the vulnerability that turns your own website into a weapon against the people who trust it. Here's how a single unescaped input can steal sessions, drain accounts, and impersonate your users — and how to shut it down.
SQL Injection: The 25-Year-Old Bug Still Emptying Databases
It's one of the oldest vulnerabilities on the internet, and it still shows up in fresh code every single day. Here's how a single quote mark can hand an attacker your entire database — and why AI-generated apps keep reintroducing it.
Clickjacking: When Your Website Becomes an Invisible Weapon
Your site can be loaded, invisibly, on top of an attacker's page — tricking your users into clicking things they never meant to. It's called clickjacking, and one missing header stops it. Here's how it works.
Session Hijacking and the Cookies You Forgot to Secure
The cookie that keeps your users logged in is also the thing an attacker wants most. Three small flags decide whether it's protected or up for grabs. Here's how session hijacking works and how to lock your cookies down.
Exposed Database Backups: The Breach You Hand to Attackers
You did everything right to secure your database — then left a backup of it sitting in a public folder. Exposed dumps and backups are one of the easiest wins an attacker can get. Here's how they find them, and how to make sure they don't.
Credential Stuffing: Why Your Login Page Is Under Attack Right Now
Attackers don't need to guess your users' passwords — they already have them, stolen from other sites. Credential stuffing is quietly one of the biggest threats to any app with a login. Here's how it works and how to blunt it.
Why "It's Just HTTP" Is a Security Disaster
Serving a site over plain HTTP in the current year isn't just outdated — it exposes every password, cookie, and byte your users send. Here's exactly what goes wrong without HTTPS, and why a redirect isn't enough on its own.
Server-Side Request Forgery: Making Your Server Attack Itself
SSRF tricks your own server into making requests an attacker chooses — reaching internal systems, cloud metadata, and secrets that should never be exposed. It's behind some of the largest cloud breaches ever. Here's how it works.
The Anatomy of a Website Hack: From Recon to Breach
Real attacks aren't a single dramatic moment — they're a patient sequence of small steps, each opening the door to the next. Walk through how attackers actually go from "never heard of you" to "inside your database," and where the chain breaks.
Vibe Coding Is Fast. Its Security Debt Is Real.
Vibe coding lets anyone ship working software in days — but "working" isn't "secure." Here's the security debt AI-generated apps quietly accumulate, and how to catch it before an attacker does.
Subdomain Takeover: How Forgotten DNS Becomes a Breach
A DNS record pointing at a service you no longer use can let an attacker host content on your domain. Here's how subdomain takeover works.
GraphQL Introspection: Handing Attackers Your API Map
Introspection is great in development and dangerous in production. Here's why you should disable it on your live GraphQL API.
Default Credentials: The Door You Forgot to Lock
Admin panels and devices shipped with default logins are among the easiest ways in. Here's why they're so dangerous.
Exposed Source Maps: Reverse-Engineering Your Frontend
Public .map files reconstruct your original, commented source code from minified bundles. Here's what that reveals.
Security Headers That Actually Matter
CSP, HSTS, and a handful of HTTP headers do a huge amount of your site's defensive work. Here's what each one does and how to set it.
.DS_Store Files: The Quiet Directory Leak
That tiny macOS file you never think about can map your server's hidden folders for an attacker. Here's why it matters.
The Danger of Exposed .env Files
A single publicly reachable .env file can hand an attacker your database, your payment keys, and your entire application. Here's how it happens and how to stop it.
Why an Exposed .git Directory Is a Goldmine for Attackers
If your /.git folder is reachable, an attacker can reconstruct your entire source code — including secrets you deleted long ago.
Open Redirects: The Vulnerability That Weaponizes Your Domain
An open redirect lets attackers use your trusted domain to send victims to malicious sites. Here's how it works and how to prevent it.
Leaked API Keys in Your JavaScript Bundles
Secrets bundled into your frontend JavaScript are visible to anyone who opens the developer tools. Here's how keys leak and what to do.