Episodes
Your admin vault is guarded by display: none
We hired a crew to rob our own app. It took four seconds: the admin button was hidden, but the API never checked who was calling. Here are the three locks that stop it.
THE ASTER BLOG / A CLOSER LOOK
A little context.
A better build.
AI moves fast. Make sense of what matters.
News, useful tools, and practical ideas for the code you ship.
THE READING ROOM
Fresh perspectives.
Practical takeaways.
Latest dispatch
8 stories to explore
Short reads. Original sources.
AI News
4 AI stories you can’t miss: Gemini 4 Argon, the FTC, GLM-5.3 and ElevenLabs
A model that can answer in a million tokens, a federal probe into two AI labs, an open model that writes exploits almost as well as Claude, and a $22 billion voice company. Here’s what happened and why it matters if you build with AI.
Episodes
Anyone can fake a Stripe “payment succeeded”. Verify your webhook
Your webhook is a doorman who signs for any package from anyone in a delivery vest. A URL isn’t a password, and “payment succeeded” is just JSON anyone can type. Here’s how to make the doorman check signatures, why the check “kept failing”, and the three moves that close the hole.
Episodes
Your API key is public? How to protect API keys in your frontend
Anything that starts with NEXT_PUBLIC_ or VITE_ ships to every visitor. Here’s how to find a leaked key in two minutes, move it to the server with copy-paste code, and rotate it properly if it already reached GitHub.
Specials
Is Jean Phil real? How to spot an AI influencer (and the coin behind it)
A deadpan Frenchman shadowboxing around Paris picked up hundreds of thousands of followers in two weeks. Then people noticed his hair never moved, and a coin showed up in his bio. Here’s what’s reported, how this kind of video is made, and how to spot the next one.
Episodes
Three users, a $3,000 AI bill? How to protect your AI endpoint
Your API key can be perfectly safe on the server and you can still get a bill you can’t pay. If your AI route has no login, no rate limit and no spending cap, anyone can use it on your card. Here’s how to close the pump.
Episodes
Strangers can see your users? The Supabase RLS guide
Your Supabase key is public by design. Row Level Security is the only thing standing between it and every row of your users table. Here’s how to turn it on, write policies that work, and prove it as a stranger.
AI News
4 AI stories you can’t miss this week
A faster, cheaper Claude, a flagship model pulled over safety, a conference all about agents, and voice cloning in 10 seconds. Here’s what happened and why it matters if you build with AI.
No stories found.
Try a different search or browse all posts.
Your reading list is saved in this browser. No account needed.
YOUR FEED, WITH A LITTLE MORE CONTEXT
See it. Save it.
Build something better.
Catch the short version on your favorite platform.
Come back here for the details and sources.