Seatbelt Labs
Research and write-ups
What we measure, the risks we document, and incidents worth learning from. Method first, sources attached. Corpus artifacts stay local; we publish method and results with caveats.
Write-ups
- July 20The NEXT_PUBLIC_ prefix leak class in the wildWhy public env prefixes turn server secrets into browser bundles, with measured incidence from URL scans.
- July 19Tea app, July 2025: open Firebase storage in productionWhat Forbes and 404 Media reported when a dating-safety app left verification selfies readable to anyone.
- July 18How we bench vibe-code scanners (and what the numbers mean)Four competitors, 42 labeled cases, and the authored-corpus caveat we put in the first paragraph.
Evergreen risk explainers live on Common risks. Scan method: How Seatbelt scans.