Your app is a bank. Here’s how it gets robbed.
Short animated stories, no jargon. Watch each common web vulnerability happen inside a bank, then see the simple fix. Built for people who ship apps with AI tools.
The bank in one minute
Every web app has the same parts as a bank. Learn them once and every guide here makes sense.
A tour of the bank floor plan: customers arrive from the street, pass the front door and the ID desk, are served at the teller window, which consults the account records and the vault.
Imagine your app is a bank. Customers are your users, arriving from the street, which is the internet.
Alice says: Hi, I’d like to use my account.10 parts of the bank
Each part is a different place a robber might try. Pick one to see what can go wrong.
The Front Door
Browser protections: headers, cross-site rules, redirects and what your pages expose.
The ID Desk
Login, sessions, tokens, password resets and rate limits.
The Teller Window
Everything users type or send that your server acts on: queries, commands, URLs and uploads.
Account Access
Authorization: who can see or change which records.
The Vault
Secrets, API keys and the third-party code you depend on.
The Building
Containers, clusters, cloud config and deployment scripts.
The Blueprints
Your attack surface: endpoints, hidden routes, API schemas and debug interfaces.
The Rulebook
Database schemas, security rules and middleware that enforce policy for every request.
The Back Office
Business logic: races, limits and flows that work as coded but not as intended.
The New Hire
AI coding tools and agents: what they read, what they write, what you let them touch.
Check your own app
isitsecure is the free, open-source scanner behind these guides. It checks for most of the problems you’ll read about here. Needs Python 3.11+ and git. The rule-based scans need no API key; the optional AI review uses your own.
isitsecure scan https://your-app.com --llm noneisitsecure scan --repo ./your-app --mode code-only --llm none