DenyFirst blog
Notes on the bugs we find
Broken access control in AI-built app backends — how it happens, how to check your own app, and how to close it.
- 2026-08-09
A security scanner that refuses to run
A tool that probes live backends is one config flag away from being an attack tool. DenyFirst won't scan anything until you prove you own it — and that constraint is the product, not a speed bump.
- 2026-08-09
Supabase gives you a public API the moment you create a table. RLS is what stands between it and a breach.
PostgREST turns every table into a REST endpoint the anon key can reach. If Row Level Security is off or permissive, 'anonymous' means the entire internet — reading and sometimes writing your rows.
- 2026-08-08
The one Firebase rule that leaks everyone's data: allow read: if request.auth != null
It looks like security. It reads like a lock. It's the single most common serious bug in AI-built apps — and it means any account can read every account's data.
- 2026-08-08
Your login screen protects the UI, not the data
AI builders wire a beautiful frontend to a set of Next.js /api routes and forget that the login page only guards the pixels. The data behind it is often one unauthenticated GET away.