Flowpatrol Blog Security insights, product updates, and engineering deep-dives from the Flowpatrol team. https://flowpatrol.ai/blog en Fri, 03 Jul 2026 05:42:26 GMT <![CDATA[Three Apps. Three Firebase Breaches. One Rule That Caused All of Them.]]> https://flowpatrol.ai/blog/firebase-security-rules-test-mode-is-not-a-strategy https://flowpatrol.ai/blog/firebase-security-rules-test-mode-is-not-a-strategy Mon, 11 May 2026 00:00:00 GMT Security Flowpatrol Team <![CDATA[SSRF in 60 seconds: the link preview that steals your AWS keys]]> https://flowpatrol.ai/blog/ssrf-the-link-preview-that-steals-your-aws-keys https://flowpatrol.ai/blog/ssrf-the-link-preview-that-steals-your-aws-keys Mon, 04 May 2026 00:00:00 GMT Security Flowpatrol Team <![CDATA[Your code passed the linter. Your app failed a 2-minute curl test.]]> https://flowpatrol.ai/blog/the-two-things-vibe-coding-security-tools-miss https://flowpatrol.ai/blog/the-two-things-vibe-coding-security-tools-miss Mon, 04 May 2026 00:00:00 GMT Security Flowpatrol Team <![CDATA[The app making $100K a month had no auth middleware. It took 2 minutes to find out.]]> https://flowpatrol.ai/blog/abrahub-2-minute-breach https://flowpatrol.ai/blog/abrahub-2-minute-breach Thu, 30 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[Lovable Builds Your App. For 48 Days, Anyone on Lovable Could Read It.]]> https://flowpatrol.ai/blog/lovable-48-day-tenant-isolation-breach https://flowpatrol.ai/blog/lovable-48-day-tenant-isolation-breach Thu, 30 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[The AI Took 9 Seconds. The Recovery Took 30 Hours.]]> https://flowpatrol.ai/blog/pocketos-cursor-claude-deleted-database-9-seconds https://flowpatrol.ai/blog/pocketos-cursor-claude-deleted-database-9-seconds Thu, 30 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[Your AI wrote a deep-merge endpoint. Here's what happens when you POST __proto__ to it.]]> https://flowpatrol.ai/blog/prototype-pollution-lodash-deep-merge-drill https://flowpatrol.ai/blog/prototype-pollution-lodash-deep-merge-drill Tue, 28 Apr 2026 00:00:00 GMT Security Flowpatrol Team <![CDATA[Same default, four breaches: what Moltbook, Tea, Cal AI, and Quittr all shipped to production]]> https://flowpatrol.ai/blog/same-default-four-breaches https://flowpatrol.ai/blog/same-default-four-breaches Thu, 16 Apr 2026 00:00:00 GMT Explainer Flowpatrol Team <![CDATA[Your Stripe webhook is probably missing one line. Here's the 60-second test.]]> https://flowpatrol.ai/blog/zero-dollar-forever-stripe-webhook-walkthrough https://flowpatrol.ai/blog/zero-dollar-forever-stripe-webhook-walkthrough Mon, 13 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[600,000 confessions from a quit-porn app. Firebase stored them all behind `allow read, write: if true`.]]> https://flowpatrol.ai/blog/quittr-firebase-600k-confessions https://flowpatrol.ai/blog/quittr-firebase-600k-confessions Sun, 12 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[Your Agent Builds Apps. Who Checks the Security?]]> https://flowpatrol.ai/blog/your-agent-builds-apps-who-checks-security https://flowpatrol.ai/blog/your-agent-builds-apps-who-checks-security Fri, 10 Apr 2026 00:00:00 GMT Product Flowpatrol Team <![CDATA[The axios hack: a quick check to see if you got compromised, and a step-by-step cleanup if you did.]]> https://flowpatrol.ai/blog/axios-rat-10-minute-incident-runbook https://flowpatrol.ai/blog/axios-rat-10-minute-incident-runbook Thu, 09 Apr 2026 00:00:00 GMT Security Flowpatrol Team <![CDATA[The OTP Wall of Broken Locks: Real-World Verification Bypasses That Keep Happening]]> https://flowpatrol.ai/blog/otp-bypass-real-breaches https://flowpatrol.ai/blog/otp-bypass-real-breaches Thu, 09 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[Shai-Hulud: The First Self-Replicating npm Worm]]> https://flowpatrol.ai/blog/shai-hulud-npm-worm-debug-chalk https://flowpatrol.ai/blog/shai-hulud-npm-worm-debug-chalk Wed, 08 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[One Line of Code Stole Your Emails: The First MCP Supply Chain Attack]]> https://flowpatrol.ai/blog/postmark-mcp-one-line-stole-your-emails https://flowpatrol.ai/blog/postmark-mcp-one-line-stole-your-emails Tue, 07 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[The Replit Agent Deleted My Database. When I Told It to Stop, It Ignored Me.]]> https://flowpatrol.ai/blog/replit-ai-deleted-my-database https://flowpatrol.ai/blog/replit-ai-deleted-my-database Tue, 07 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[Azure Sign-In Log Bypass: Four Bugs That Made Logins Invisible]]> https://flowpatrol.ai/blog/azure-signin-log-bypass-invisible-logins https://flowpatrol.ai/blog/azure-signin-log-bypass-invisible-logins Mon, 06 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[IDOR in 60 seconds: change a 1 to a 2 and see what comes back]]> https://flowpatrol.ai/blog/change-a-1-to-a-2-idor-walkthrough https://flowpatrol.ai/blog/change-a-1-to-a-2-idor-walkthrough Mon, 06 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[Claude Code has two memories. Yours probably should too.]]> https://flowpatrol.ai/blog/claude-code-two-memories https://flowpatrol.ai/blog/claude-code-two-memories Mon, 06 Apr 2026 00:00:00 GMT Builders Flowpatrol Team <![CDATA[Most AI-built Supabase apps leak their users table. Here's how to check yours in 2 minutes.]]> https://flowpatrol.ai/blog/from-login-to-database-rls-walkthrough https://flowpatrol.ai/blog/from-login-to-database-rls-walkthrough Mon, 06 Apr 2026 00:00:00 GMT Security Flowpatrol Team <![CDATA[How Supabase RLS Gave Users Two Ways to Go Premium]]> https://flowpatrol.ai/blog/subscription-self-upgrade-the-free-premium-hack https://flowpatrol.ai/blog/subscription-self-upgrade-the-free-premium-hack Mon, 06 Apr 2026 00:00:00 GMT Security Flowpatrol Team <![CDATA[Admin Panels Wide Open: The Door AI Forgot to Lock]]> https://flowpatrol.ai/blog/admin-panels-wide-open-the-door-ai-forgot-to-lock https://flowpatrol.ai/blog/admin-panels-wide-open-the-door-ai-forgot-to-lock Sun, 05 Apr 2026 00:00:00 GMT Security Flowpatrol Team <![CDATA[Langflow RCE: Code Execution Before the Auth Check — Two Years Open, Then a Botnet]]> https://flowpatrol.ai/blog/langflow-rce-exec-before-authentication https://flowpatrol.ai/blog/langflow-rce-exec-before-authentication Sun, 05 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[npm Supply Chain Hygiene for Vibe Coders]]> https://flowpatrol.ai/blog/npm-supply-chain-hygiene-for-vibe-coders https://flowpatrol.ai/blog/npm-supply-chain-hygiene-for-vibe-coders Sat, 04 Apr 2026 00:00:00 GMT Guides Flowpatrol Team <![CDATA[Your Sign-Up Flow Has a Backdoor]]> https://flowpatrol.ai/blog/signup-flow-backdoor-ai-code https://flowpatrol.ai/blog/signup-flow-backdoor-ai-code Sat, 04 Apr 2026 00:00:00 GMT Security Flowpatrol Team <![CDATA[AI Agent Safety: What Your Agent Can Destroy (And How to Stop It)]]> https://flowpatrol.ai/blog/ai-agent-safety-what-your-agent-can-destroy https://flowpatrol.ai/blog/ai-agent-safety-what-your-agent-can-destroy Fri, 03 Apr 2026 00:00:00 GMT Guides Flowpatrol Team <![CDATA[CamoLeak: A PR Comment Made Copilot Steal Your Private Code]]> https://flowpatrol.ai/blog/camoleak-github-copilot-cve-2025-59145 https://flowpatrol.ai/blog/camoleak-github-copilot-cve-2025-59145 Fri, 03 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[Cursor IDE Vulnerabilities: When Your Code Editor Becomes the Attack Vector]]> https://flowpatrol.ai/blog/cursor-ide-vulnerabilities-when-your-editor-attacks https://flowpatrol.ai/blog/cursor-ide-vulnerabilities-when-your-editor-attacks Fri, 03 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[How to Secure Your MCP Setup]]> https://flowpatrol.ai/blog/how-to-secure-your-mcp-setup https://flowpatrol.ai/blog/how-to-secure-your-mcp-setup Fri, 03 Apr 2026 00:00:00 GMT Guides Flowpatrol Team <![CDATA[The axios maintainer had 2FA enabled. North Korea took his npm account anyway.]]> https://flowpatrol.ai/blog/axios-npm-2fa-enabled-didnt-help https://flowpatrol.ai/blog/axios-npm-2fa-enabled-didnt-help Thu, 02 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[Wix Paid $80 Million for Base44. Weeks Later, Two API Calls Broke Every Auth System.]]> https://flowpatrol.ai/blog/base44-auth-bypass-80m-acquisition https://flowpatrol.ai/blog/base44-auth-bypass-80m-acquisition Thu, 02 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[3.2 Million Health Records Exposed: The Firebase Rule That Said Yes to Everyone]]> https://flowpatrol.ai/blog/cal-ai-firebase-3-million-health-records https://flowpatrol.ai/blog/cal-ai-firebase-3-million-health-records Thu, 02 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[Polyfill.io: 380,000 Sites, One CDN, One Domain Sale]]> https://flowpatrol.ai/blog/polyfill-io-380000-sites-one-cdn-one-domain-sale https://flowpatrol.ai/blog/polyfill-io-380000-sites-one-cdn-one-domain-sale Thu, 02 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[Tea: 72,000 Government IDs, 1.1 Million Private Messages. A Firebase Bucket With No Lock.]]> https://flowpatrol.ai/blog/tea-app-firebase-72000-government-ids https://flowpatrol.ai/blog/tea-app-firebase-72000-government-ids Thu, 02 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[The Five Ways React's Escaping Fails — And How AI Makes You Ship Them]]> https://flowpatrol.ai/blog/xss-in-react-dangerously-set-inner-html https://flowpatrol.ai/blog/xss-in-react-dangerously-set-inner-html Thu, 02 Apr 2026 00:00:00 GMT Security Flowpatrol Team <![CDATA[XZ Utils Backdoor: The 3-Year Long Con]]> https://flowpatrol.ai/blog/xz-utils-backdoor-the-3-year-long-con https://flowpatrol.ai/blog/xz-utils-backdoor-the-3-year-long-con Thu, 02 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[916 Firebase Projects Left Wide Open: 125 Million Records, 19 Million Plaintext Passwords, Zero Warnings]]> https://flowpatrol.ai/blog/firebase-misconfiguration-125-million-records https://flowpatrol.ai/blog/firebase-misconfiguration-125-million-records Wed, 01 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[CVE-2025-29927: The Next.js Middleware Bypass That Broke Auth With One Header]]> https://flowpatrol.ai/blog/nextjs-middleware-bypass-cve-2025-29927 https://flowpatrol.ai/blog/nextjs-middleware-bypass-cve-2025-29927 Wed, 01 Apr 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[Ship Faster with Security in Your Terminal]]> https://flowpatrol.ai/blog/flowpatrol-cli-launch https://flowpatrol.ai/blog/flowpatrol-cli-launch Tue, 31 Mar 2026 00:00:00 GMT Product Flowpatrol Team <![CDATA[Security Checks on Every Pull Request]]> https://flowpatrol.ai/blog/flowpatrol-github-action-launch https://flowpatrol.ai/blog/flowpatrol-github-action-launch Tue, 31 Mar 2026 00:00:00 GMT Product Flowpatrol Team <![CDATA[IDOR: The Vulnerability AI Can't See]]> https://flowpatrol.ai/blog/idor-the-vulnerability-ai-cant-see https://flowpatrol.ai/blog/idor-the-vulnerability-ai-cant-see Sun, 29 Mar 2026 00:00:00 GMT Security Flowpatrol Team <![CDATA[The Moltbook Breach: 1.5 Million API Tokens Exposed Because RLS Was Off]]> https://flowpatrol.ai/blog/moltbook-breach-1-5-million-api-tokens https://flowpatrol.ai/blog/moltbook-breach-1-5-million-api-tokens Sun, 29 Mar 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[The OWASP Top 10 for Vibe Coders: What Your AI Actually Built]]> https://flowpatrol.ai/blog/owasp-top-10-guide https://flowpatrol.ai/blog/owasp-top-10-guide Sun, 29 Mar 2026 00:00:00 GMT Security Flowpatrol Team <![CDATA[SQL Injection Is Not Dead: How AI Keeps Reinventing It Under Modern ORMs]]> https://flowpatrol.ai/blog/sql-injection-in-ai-generated-code https://flowpatrol.ai/blog/sql-injection-in-ai-generated-code Sun, 29 Mar 2026 00:00:00 GMT Security Flowpatrol Team <![CDATA[Your .env Is Showing: Environment Variable Exposure in Vibe-Coded Apps]]> https://flowpatrol.ai/blog/your-env-is-showing https://flowpatrol.ai/blog/your-env-is-showing Sun, 29 Mar 2026 00:00:00 GMT Security Flowpatrol Team <![CDATA[How to Secure Your Lovable App Before You Launch]]> https://flowpatrol.ai/blog/how-to-secure-your-lovable-app https://flowpatrol.ai/blog/how-to-secure-your-lovable-app Sat, 28 Mar 2026 00:00:00 GMT Guides Flowpatrol Team <![CDATA[The Lovable RLS Leak: 170+ Apps, 303 Open Endpoints, and a Database You Could Query From the Browser]]> https://flowpatrol.ai/blog/lovable-rls-vulnerability-170-apps-exposed https://flowpatrol.ai/blog/lovable-rls-vulnerability-170-apps-exposed Sat, 28 Mar 2026 00:00:00 GMT Case Study Flowpatrol Team <![CDATA[What Happens When a Vibe-Coded App Gets Hacked: A Step-by-Step Breakdown]]> https://flowpatrol.ai/blog/what-happens-when-vibe-coded-app-gets-hacked https://flowpatrol.ai/blog/what-happens-when-vibe-coded-app-gets-hacked Sat, 28 Mar 2026 00:00:00 GMT Security Flowpatrol Team <![CDATA[Why We Use LLMs for Security Testing (And What They Actually Catch)]]> https://flowpatrol.ai/blog/why-llms-for-security https://flowpatrol.ai/blog/why-llms-for-security Sat, 28 Mar 2026 00:00:00 GMT Engineering Flowpatrol Team <![CDATA[Introducing Flowpatrol: You Shipped It. Now Make Sure It's Solid.]]> https://flowpatrol.ai/blog/introducing-flowpatrol https://flowpatrol.ai/blog/introducing-flowpatrol Fri, 27 Mar 2026 00:00:00 GMT Product Flowpatrol Team <![CDATA[Your Supabase Anon Key Is Public. Without RLS, So Is Your Database.]]> https://flowpatrol.ai/blog/supabase-rls-the-security-feature-your-ai-forgot https://flowpatrol.ai/blog/supabase-rls-the-security-feature-your-ai-forgot Fri, 27 Mar 2026 00:00:00 GMT Security Flowpatrol Team