The loophole library.

The 10 security holes we find most often in apps built fast or with AI tools. Each page explains the risk in plain English, shows how to check your own app, and gives the cure with code.

5 critical
4 high
1 medium

Critical

Secret keys in the frontend

Payment, AI and database keys shipped to every visitor's browser.

See the cure

Critical

Database open to everyone

Supabase or Firebase tables any logged-in (or anonymous) user can read and edit.

See the cure

Critical

Other users' data by changing an ID

Change /invoices/123 to /invoices/124 and see someone else's invoice.

See the cure

Critical

Fake payment webhooks

Anyone can POST “payment succeeded” to your webhook and unlock a paid plan.

See the cure

Critical

SQL & command injection

User input glued into a query or shell command.

See the cure

High

Admin pages hidden, not protected

The admin button is hidden in the UI, but the admin API answers anyone.

See the cure

High

No rate limits

See the cure

High

AI features that can be talked into anything

Users trick your AI into leaking data, prompts or running tools it shouldn't.

See the cure

High

Outdated packages with known holes

Libraries in your lockfile with public, exploitable vulnerabilities.

See the cure

Medium

Wide-open CORS & missing security headers

Any website can call your API with your users' cookies.

See the cure

Not sure which of these you have?

That's normal. Send us your app's URL and we'll find out, then give you the cure.

Talk to us on WhatsApp