threat radar

What is burning people right now.

Incidents, advisories and research that matter if you ship with AI. Tap a blip or a card for the story, the lesson, and the receipt. Severity pulls a blip toward the center.

live · security brain feed

criticalhighmedlow

closer to center = closer to hurting you

What is burning people right now.

Missing Authentication on API Routes

Exposing Supabase Service Keys in Client-Side Code

Prompt injection in an AI code review bot let attackers approve their own PRs

High incidence of secret exposure in vibe coded applications

Exposed Firebase Configurations with Write Access

Exposed Customer Records via Unauthenticated Admin API

AI-assisted Repos Expose Secrets through Hardcoded Keys

IDOR in project export endpoint exposes all users' source code

Blocked Auto-Run of Shell Commands from Untrusted Repos

Presence of Hardcoded Credentials in LLM-Generated Web Applications

AI assisted commits are leaking secrets at twice the rate

Nearly half of AI written code failed security tests

Phished maintainer pushed crypto stealing code into chalk and debug

A self spreading worm infected hundreds of npm packages

Malware in Nx packages used developers own AI tools to hunt secrets

Cursor ran malicious commands after a config was approved once

Dating safety app Tea exposed selfies and IDs in an open bucket

One public ID unlocked private apps built on Base44

A stranger pull request slipped a wipe everything prompt into Amazon Q

A single email could make Microsoft Copilot leak internal files

Lovable apps left Supabase tables open to anyone

Poisoned tool descriptions turned MCP servers into data thieves

Hidden instructions in config files hijacked Cursor and Copilot

A vibe coded SaaS with no auth was drained within two days

AI coding tools invent package names that attackers can register