Articles
One problem per article, the kind that shows up in apps built fast. What it is, how to spot it in your own project, and how to fix it.
Does SOC 2 Require a Pentest?
The SOC 2 criteria don't mandate a penetration test, but auditors and enterprise buyers often expect one. What the AICPA text says and what to buy.8 min readNext.js Server Actions Are Public Endpoints
Any exported Next.js server action can be called with a direct POST. Why proxy and page checks don't cover it, a curl repro, the fix, and patched versions.9 min readStripe secret key in NEXT_PUBLIC_: find, fix and rotate it
A NEXT_PUBLIC_ variable is inlined into the JavaScript every visitor downloads. How a Stripe secret key gets there, how to find it, and how to rotate it.7 min readStripe Webhook Signature Verification in Next.js
Verify Stripe webhooks in a Next.js App Router route: raw body, constructEvent, the right whsec_ secret, and dedupe by event ID. With tests.8 min readSupabase anon key vs service_role key: which goes where
The anon (publishable) key is built for the browser. The service_role (secret) key bypasses RLS and stays on your server. How to tell which you shipped.8 min readSupabase RLS: the two-account test that proves it holds
What RLS in Supabase is, why "RLS enabled" can still leak, and a two-account SQL test you can run locally to prove one user can't read another's rows.9 min read