Field notes
Practical write-ups on migrating off no-code builders, securing AI-written code, and shipping products that last.
Find a security guide for your builder or AI coding tool
Sep 24, 2026 · 8 min read
Buying a micro-SaaS? Ask for a working handover.
Check code, accounts, deploys, backups and recurring costs before a micro-SaaS handover. Use a practical worksheet to record evidence and unresolved risks.
ReadSep 19, 2026 · 4 min read
Windsurf security guide: Cascade commands and app checks
Check Windsurf command execution, terminal credentials and generated changes. Test app permissions and external side effects before shipping a customer release.
ReadSep 19, 2026 · 4 min read
Webflow security guide: scripts, forms and API tokens
Review Webflow custom scripts, form destinations, API tokens and connected member systems. Check the published site and integrations before a sensitive launch.
ReadSep 19, 2026 · 4 min read
Vibe App Scanner: turning checks into useful findings
How Thunkle's Vibe App Scanner separates scan jobs, evidence and remediation, and why platform context and developer review matter in a security product.
ReadSep 19, 2026 · 4 min read
v0 security guide: Server Actions, data and secrets
Review v0-generated apps for Server Action authorization, excessive response data and exposed secrets. Check preview and production before a customer launch.
ReadSep 19, 2026 · 4 min read
Softr security guide: user groups and data restrictions
Check Softr user groups, global data restrictions and connected portal workflows. Verify record access, writes and integrations before inviting real customers.
ReadSep 19, 2026 · 9 min read
Sample security audit report for an AI-built app
See an illustrative app security audit report with scope, evidence, impact, remediation and re-test criteria. Understand what a developer-led review delivers.
ReadSep 19, 2026 · 4 min read
Replit security guide: routes, Secrets and deployment
Review Replit server routes, Secrets and deployment boundaries. Test your published app's permissions before launch and identify where an audit adds value.
ReadSep 19, 2026 · 9 min read
Platform migration scope: functions, data and integrations
Use this migration worksheet to inventory functions, integrations, auth, data and cutover requirements before asking for a developer-verified quote.
ReadSep 19, 2026 · 4 min read
Security guides for no-code and AI-built apps
Find security checklists for no-code builders and AI coding tools, including Lovable, Base44, Claude Code, Codex and Cursor. Know what to test before launch.
ReadSep 19, 2026 · 4 min read
Lovable SEO: diagnose indexing before you rebuild
Check your Lovable site's indexing, canonical URLs, content and rendering. Follow a practical diagnosis and know when developer-led SEO work is worth it.
ReadSep 19, 2026 · 8 min read
Lovable security guide: what to check before launch
Check your Lovable app's access rules, files, backend functions and secrets. Learn what built-in scans cover and when a security audit makes sense.
ReadSep 19, 2026 · 4 min read
Glide security guide: Row Owners and shared data
Review Glide Row Owners, user profiles and connected data sources. Test what each account receives before launching a portal with private records.
ReadSep 19, 2026 · 4 min read
GitHub Copilot security guide: from agent to release
Review GitHub Copilot permissions, setup steps, MCP access and pull requests. Use evidence-backed security checks before merging generated code.
ReadSep 19, 2026 · 4 min read
Framer security guide: components, forms and webhooks
Check Framer code components, custom scripts and signed form webhooks. Review the published site, protect provider credentials and decide when an audit helps.
ReadSep 19, 2026 · 4 min read
FlutterFlow security guide: private APIs and data rules
Review FlutterFlow private APIs, backend permissions and mobile releases. Check what authentication protects before your app handles customer data.
ReadSep 19, 2026 · 4 min read
Cursor security guide: editor access and app permissions
Review Cursor agent access, MCP connections and generated code. Check customer isolation and privileged actions in the application you actually ship.
ReadSep 19, 2026 · 4 min read
Content Carousel: engineering a durable AI workflow
Inside Thunkle's Content Carousel: durable generation jobs, usage reservations, image and video rendering, and the engineering behind a usable AI product.
ReadSep 19, 2026 · 4 min read
Codex security guide: agent access and release checks
Check Codex sandboxing, approvals and connected tools, then test the app it builds. A practical security guide for teams preparing AI-written code for release.
ReadSep 19, 2026 · 4 min read
Claude Code security guide: permissions and app reviews
Review Claude Code permissions, project instructions and generated application changes. Use a practical release checklist and know when to get a code audit.
ReadSep 19, 2026 · 4 min read
Bubble security guide: privacy rules, APIs and files
Check Bubble privacy rules, Data API types, backend workflows and private files. Test your app's permissions before launch or request a scoped audit.
ReadSep 19, 2026 · 4 min read
Bolt security guide: database access and launch checks
Check your Bolt app's database, access rules, server functions and shipped secrets. Turn platform checks into evidence before launching with customers.
ReadSep 19, 2026 · 9 min read
Base44 security guide: permissions, roles and APIs
Review Base44 entity rules, field permissions, roles and backend functions. Use a practical launch checklist and understand when to get a security audit.
ReadSep 19, 2026 · 4 min read
AI app security audit cost: scope, report and fixes
Understand Thunkle's security audit starting price, what changes the scope, what your report includes and how remediation and a free re-review fit together.
ReadSep 18, 2026 · 6 min read
Where frontend environment variables actually end up
An 11-case Vite and Next.js experiment: synthetic secrets in JavaScript, HTML and RSC output. Download the fixtures, results and exact-match checker.
ReadSep 9, 2026 · 6 min read
What a one-account security test misses
A reproducible Supabase experiment across four access-control configurations: why owner reads and signed-out checks can miss cross-account exposure.
ReadSep 9, 2026 · 5 min read
Test Supabase RLS with two accounts
Check private-row isolation with two users, positive controls and signed-out requests. Free Supabase checker, SQL fixture and authorization worksheet.
ReadAug 20, 2026 · 6 min read
SEO without SSR: how far you can actually get
Google renders JavaScript, so a client-rendered app can rank. The wall is everything that is not Googlebot: AI crawlers, link previews and slow first paint. Where the line sits, and what to do on each side of it.
ReadAug 2, 2026 · 5 min read
Every Supabase key: which can be public?
Understand publishable, secret, anon and service_role keys. Check what shipped, replace compromised credentials and review the access rules behind public keys.
ReadJul 27, 2026 · 5 min read
What Bubble's Security Dashboard won't fix for you
Bubble's Security Dashboard flags missing privacy rules. Learn what it cannot fix and why a green dashboard may still leave data exposed.
ReadJul 26, 2026 · 7 min read
What goes wrong inside Framer code components
What can go wrong in Framer code components: exposed API keys, untrusted imports and content turned into executable markup.
ReadJul 6, 2026 · 5 min read
Auditing an app built to be insecure
A walkthrough of a deliberately vulnerable app: exposed secrets, an open user list, broken access control and findings scanners miss.
ReadJun 30, 2026 · 10 min read
AI app security review: the flaws we find most often
The access-control flaws, exposed secrets and misconfigurations found most often in apps built on Lovable, Base44 and Replit.
Read
Get them in your inbox
Be the first to read each field note. No noise, just the good stuff.