Security for people who build with AI

Short, practical, no jargon. Everything here is something we would tell a friend who just shipped an app. RSS

• October 15, 2026 · 4 min read

  What happens when SixthWall scans your pull request

  What the SixthWall GitHub App fetches, what it never sees, how the check passes or fails, and how to keep it quiet without turning it off.

• October 15, 2026 · 4 min read

  Row Level Security: the Supabase setting your AI app cannot skip

  Lovable, Bolt and Cursor apps ship the Supabase key in the browser. Only Row Level Security protects your data. Check yours in five minutes.

• October 15, 2026 · 4 min read

  Your MCP server is a server: the bug now showing up in CVEs

  MCP servers built with Claude Code are getting CVEs for command injection and open HTTP endpoints. What the bug looks like, why AI writes it, and how to scan for it.

• September 21, 2026 · 3 min read

  Why we use fixed rules instead of asking an LLM to review your code

  An LLM review gives a different answer every run. Fine for advice, bad for a safety check. Why SixthWall uses fixed rules, and what that costs.

• September 21, 2026 · 4 min read

  Is vibe coding safe? A checklist before you share the link

  Built it with Lovable, Cursor, Bolt, v0 or Claude Code? Eight things to check before real people use it, in plain English, with the fix for each.

• September 21, 2026 · 3 min read

  How to make Claude Code check its own code for security issues

  A five-minute setup that gives Claude Code a security scanner as an MCP tool, so it scans after every change and fixes what it finds.