Blog
The AppSafe blog
Practical security for people who ship fast. Checklists, launch guides, and lessons from scanning AI-built apps.
Fake AI crawlers are hunting your .env files. Here's how to check yours
Credential scanners are borrowing the names of AI crawlers to slip past allowlists, and they're asking for one file in particular: your .env. How to check whether yours is reachable, and how to lock it down.
Read postThe Railway breach: how to rotate your app's secrets without downtime
Railway told every user to roll their environment variables after attackers went after AI and platform API keys. How to check your exposure, rotate everything without taking your app down, and make the next breach hurt less.
Read postPHP2Shell is being exploited: how to check if your app is exposed
Two critical bugs in PHP itself went from "patch released" to "exploited in the wild" in days. How to find out whether anything you host runs an affected version, and what to do about it today.
Read postShipping an AI-built app? Check these 7 things before you launch
AI coding tools optimize for "it works," not "it's safe to ship." These are the seven issues we check for first on any freshly launched app — and the fix for each one.
Read postPrefer reference guides?
The Learn section explains every issue AppSafe scans for — what it is, why it matters, and how to fix it.
Browse the guides