Topics: where builders stumble
Ranked by counting the sourced stories and security incidents on this site. It's a small, growing sample, so treat it as a guide, not a survey.
Agents read web pages, files, emails and tool output that can hide instructions. Give agents the fewest permissions possible and approve anything that runs commands, sends data, deletes or pays.
0 build stories · 15 security incidents · See all with fix prompts →Plans and credits run out faster than people expect. Check usage daily, use cheaper models or plan mode for small edits, and commit progress so a limit pauses you instead of stranding work.
8 build stories · 0 security incidents · See all with fix prompts →Building fast makes it easy to build something nobody wants. Talk to users and set a price early, and have a support email ready.
6 build stories · 0 security incidents · See all with fix prompts →AI writes login quickly but often misses expiry, logout and who-can-see-what. Test logging out, expired sessions and another user's data before launch.
3 build stories · 3 security incidents · See all with fix prompts →Keys in front-end code or public repos get found and abused within hours. Keep secret keys server-side, set spend limits and turn on secret scanning.
1 build story · 5 security incidents · See all with fix prompts →After 2–3 failed fixes, stop. Restore the last working version, start a fresh chat, paste the exact error and ask for one small change.
5 build stories · 0 security incidents · See all with fix prompts →Expect weeks to learn prompting, git and debugging. Start with something small that you care about.
5 build stories · 0 security incidents · See all with fix prompts →Agents with production credentials have wiped databases. Keep production keys out of dev, turn off auto-run for commands, and test restoring a backup.
3 build stories · 2 security incidents · See all with fix prompts →Review and testing time sits on top of agent time. Keep tasks small and test the real user flows yourself.
4 build stories · 0 security incidents · See all with fix prompts →Many builders hit a ceiling and rebuild. Put code in your own Git repo early and know where your database lives.
4 build stories · 0 security incidents · See all with fix prompts →Checkout works but webhooks fail silently. Verify signatures, handle failed and duplicate events, and run one real payment before launch.
4 build stories · 0 security incidents · See all with fix prompts →Supabase/Firebase apps without row-level security expose every row to anyone with the public key. Turn on RLS and test with a second account.
0 build stories · 4 security incidents · See all with fix prompts →Keep one short project brief in the repo that every AI tool reads, enforce rules with tools, and commit working steps.
3 build stories · 0 security incidents · See all with fix prompts →AI suggests packages, extensions and MCP servers that can be malicious or vulnerable. Check the publisher and permissions before installing.
0 build stories · 3 security incidents · See all with fix prompts →"Works in preview" isn't "works on a phone". Set the app name and bundle ID before the first store build, test native login early and expect review rejections.
2 build stories · 0 security incidents · See all with fix prompts →