Blog
What we see when we run release checks on real code, with the fix for each problem. For step-by-step fixes to single bugs, see the guides.
Your SMS and AI bills are part of the attack surface
Endpoints that send an SMS code or call an LLM are billed per request. Without a limit, anyone who finds them can run up the bill. How SMS pumping and open LLM routes are abused, and the fixes.
Which keys in a SaaS stack can ship to the browser
PostHog, Langfuse, LaunchDarkly and Flagsmith give you a public key and a secret one with similar names. How to tell them apart, and the newer keys that must stay on the server.
We ran our release checks on a Flutter app and a Rust service. Most of the alarms were ours.
LocalSend and Lemmy joined the benchmark. format! in error messages, pinned self-signed certs, placeholder CI passwords and USER $NAME: what we fixed, and what was worth a look.
What a release check found in well-kept open-source apps
A fallback JWT secret, a storage policy that ignores the owner, containers running as root, CI actions pinned to tags and more, each with the fix.