https://fortus.dev/blog/ Practical security guides, code checks, and manual self-tests for builders shipping with AI. en Sat, 26 Sep 2026 12:00:00 +0000 https://fortus.dev/blog/source-maps-exposed.html https://fortus.dev/blog/source-maps-exposed.html Sat, 26 Sep 2026 12:00:00 +0000 Shipping .map files or unminified bundles leaks your source to anyone with DevTools. Learn the config flags and checks that keep prod builds private. https://fortus.dev/blog/supabase-rls-off-check.html https://fortus.dev/blog/supabase-rls-off-check.html Thu, 24 Sep 2026 12:00:00 +0000 With Row Level Security off, any logged-in user can read every row. Learn where RLS lives in migrations and how to verify owner-scoped policies. https://fortus.dev/blog/devtools-api-key-search.html https://fortus.dev/blog/devtools-api-key-search.html Tue, 22 Sep 2026 12:00:00 +0000 Your Stripe or OpenAI key may be sitting in client JavaScript. How to search your own bundle in 60 seconds and move keys server-side. https://fortus.dev/blog/swap-user-id-idor.html https://fortus.dev/blog/swap-user-id-idor.html Sun, 20 Sep 2026 12:00:00 +0000 Change one ID in your API request and you may see another user's data. Learn why IDOR is the most common vibe-code bug and how to fix it. https://fortus.dev/blog/paste-url-60-second-scan.html https://fortus.dev/blog/paste-url-60-second-scan.html Fri, 18 Sep 2026 12:00:00 +0000 Bots probe for missing HTTPS, weak headers, and exposed backups first. Run a 60-second self-review of your own app before attackers — or users — do.