free guides

The specific things that go wrong in vibe-coded apps

Ten deep-dives, one per failure mode — written to be useful on their own, whether or not you ever run a scan. Each one ends with what Solacess’s own checks add beyond a manual look.

all checks

Pick the one that matches what you're worried about.

data leak

Supabase RLS checker

RLS being "enabled" in the dashboard doesn't mean it works. Three ways it fails silently, how to check it by hand, and what an automated check adds.

money leak

Stripe webhook security test

What an unsigned webhook attack looks like as a single curl command, why HTTPS doesn't mean verified, and the idempotency trap that hits real webhooks too.

data leak

IDOR checker for SaaS apps

IDOR explained with a real URL, why it's the most common finding in AI-generated apps, and why it takes two logged-in accounts to actually prove — not one.

for Lovable builders

Is my Lovable app secure?

What Lovable's own tooling does and doesn't cover, the gap between "nothing was flagged" and "nothing's wrong", and a 5-minute manual check before you launch.

for Cursor builders

Is my Cursor app secure?

Cursor apps put more infrastructure decisions in your hands than a hosted builder does. The mistakes that shows up as, and a manual checklist before you ship.

for Claude Code builders

Claude Code app security checklist

How Claude-Code-built apps typically structure auth and data access, the single-account testing trap, and a checklist for before real customers show up.

money leak

Stripe test mode vs live mode checklist

How test and live Stripe keys actually get mixed up across environments, why it's dangerous in both directions, and a 5-minute check on your own setup.

how this category works

Free security scanner for AI-built apps

What a passive, no-signup scan can honestly prove, what authenticated scanning adds, and where two-account and payment testing fit in.

will break in production

Rate limiting checklist for SaaS auth routes

What happens with no rate limit on login, signup or password reset, a self-check you can run in a minute, and what "good" looks like for a small SaaS.

for Acquire.com / Flippa buyers

Due diligence checklist before buying a SaaS app

Financials and traffic screenshots don't show security debt. The specific things that turn into post-acquisition surprises, and where a dated report fits an offer.

Run this check against a real report, not a guess.

The sample report is a real scan of a deliberately vulnerable app — nine findings, the proof behind each one, and what they would cost.

See a real report See pricing