Blog

Practical security guides for people who built a SaaS with AI.

Firebase

Firebase Security Rules: 7 mistakes that leak your whole database

The most common Firestore and Storage rule mistakes — each with the wrong code, the right code, and why it matters.

SAST

SAST for AI-built SaaS: what Semgrep catches and what it misses

SAST, DAST and SCA explained — and the class of authorization flaws pattern tools almost always miss.

Supabase

Supabase RLS: the security guide you needed before launch

The 7 Row Level Security mistakes that leave your Postgres open to the anon key — with the wrong SQL and the right SQL.

Stripe

Stripe webhook security: 7 mistakes that unlock access for free

Signature verification, raw body, idempotency and the right event (incl. Pix/boleto) — with code.

Multi-tenant · IDOR

Multi-tenant isolation: how IDOR leaks data between customers

The #1 SaaS flaw (IDOR/BOLA) explained: the 7 patterns that let one customer read another's data, and where the check has to live.

LGPD · Compliance

LGPD for SaaS: the practical compliance checklist (Brazil's data law)

Legal basis, data-subject rights, cookies, retention, security (art. 46) and breach — the practical checklist, with what to build in code.