Come, Take Your First Byte.

The Pulse

Every Tuesday: the threats that actually moved, one fix you can ship before lunch, and the plain-English version your non-technical CEO needs to hear. Three things worth your scroll this week — all three read off CISA’s Known Exploited Vulnerabilities catalog, version 2026.09.24, in professionally built products: two are authentication or authorization checks the server got wrong; the third is a path traversal in an API gateway.

Now, this week:

The Hardened Stack

Somebody on your side of the table shipped an app this quarter that no security person ever read — a client intake portal, a technician’s internal tool, a dashboard built in an afternoon with an AI coding assistant. It works. That is not the question any more.

The measurement. Veracode’s 2026 GenAI Code Security Report (Jul 28) tracks code from more than 100 models. By Veracode’s numbers, it compiles at a near-universal ~100% syntax pass rate — and passes Veracode’s security tests 56% of the time on average, “virtually unchanged” from its previous report. Two conditions ride with that number: no security-specific prompting, and raw models — not agents, not tools with guardrails, not code a human reviewed. Veracode’s best performer that round still failed nearly one security task in three. Read it for what it is: not “AI code is bad”, but “unreviewed code is unreviewed”.

The shape, twice. In March 2025 a researcher at Replit (Matt Palmer — worth knowing Replit builds a competing AI app builder) and a colleague scanned 1,645 apps from Lovable’s own “Launched” showcase. Visiting homepages only, never logging in, their script found 170 projects (~10.3%) with 303 endpoints that would return data with inadequate Row Level Security — emails, phone numbers, payment details, developer API keys. It was published as CVE-2025-48757 in May 2025. Homepages only means that count is a floor, not a ceiling (our read).

In January 2026, Wiz researchers browsed Moltbook — a viral social network for AI agents whose founder said publicly he vibe-coded it — and within minutes found a Supabase key in the site’s client-side JavaScript. Wiz is careful here, and so are we: that was a publishable key, meant to sit in a browser. The missing piece was the server-side Row Level Security rule that makes it safe. Without it, per Wiz, the key gave unauthenticated read and write access: 1.5 million API authentication tokens, 35,000 email addresses, private messages between agents, and the ability to edit live posts. Moltbook secured it within hours of Wiz’s report. Wiz’s own summary: the issue traced back to a single Supabase configuration setting. This was a research disclosure, not an attack report. (Per Wiz, researcher Jameson O’Reilly independently found the same misconfiguration.)

Why it keeps happening. OWASP’s Top 10:2025 keeps Broken Access Control at #1, and says access control is only effective in trusted server-side code. Its own example is an app that keeps its access checks in the front end; the attacker skips the page and calls the admin URL directly. The button is hidden. The route is not. An assistant builds what was asked for — a form, a session, a redirect — and the controls that only matter under attack were never in the request.

Step 3 is the one both case studies turn on, and a policy-existence scanner cannot prove it for you: a rule that exists is not a rule that works. Palmer’s write-up (May 2025) says Lovable’s later scanner checked that a policy existed, not whether it was correct — his assessment, and the lesson holds either way. Test from the outside, as someone who should not get in.

And run it only on apps you own or are authorized to test. The same afternoon aimed at someone else’s app is a different conversation entirely.

The Boardroom Bridge

The talking point (a literal script for non-technical execs — steal it)

Boards do not fund fear. They fund an afternoon that ends in a one-page dated record either way it lands — and “we reviewed it before launch, here is the page” is an easier sentence to say to a client than any of the alternatives.

This week’s tool — AxiomLens

The afternoon gives you one dated page for one app. Keeping that true across every app and every client — tying each finding to the control it evidences, tracking the fix, and turning it into something a board reads without translation — is the grind. That rhythm is what AxiomLens systemizes: 106 subcategories, computed coverage, evidence tied to controls, board reports written on your machine. One-time, per named user, and nothing phones home after activation. It supports compliance documentation and audit-prep workflows; a tool, not a certification, and not legal, compliance, or audit advice.

One-time license — check the store for current pricing.