BreachFix

Blog

Field notes on breaking and fixing software.

What we see testing real apps: the vulnerabilities that keep showing up and how to close them. Written to be useful, for humans and models alike.

6 min readowaspsecurity

What the OWASP Top 10:2025 means for a SaaS team

The new list puts access control, configuration, and the software supply chain at the top. Here is what that changes in a practical application review.

Read→
5 min readnextjssecurity

A practical security check for a Next.js App Router app

Recent React Server Components vulnerabilities made patching urgent, but version updates are only one part of securing Server Actions, route handlers, and secrets.

Read→
6 min readsupabasepostgres

How to review Supabase RLS before real users arrive

RLS being enabled is not the same as RLS being correct. Test anonymous access, ownership, tenant isolation, views, functions, and service keys.

Read→
2 min readpentestcompliance

A scan is not a pentest, and buyers can tell

An automated scanner spits out a list. A penetration test proves what an attacker could actually do. The gap between them is where security money is won or wasted.

Read→
2 min readsecurityai

The three bugs in almost every vibe-coded app

AI writes code that works, not code that's safe. Three vulnerability patterns account for most of what breaks, and all three are quick to fix.

Read→
2 min readcompliancesoc2

Passing a security review without stalling the deal

An enterprise customer, or a SOC 2 / HIPAA auditor, is asking for a pentest and a deadline is looming. Here's what they actually need, and how to get there fast.

Read→