How these guides are made and checked
A site that teaches security should show its working. Here is what we did, what we did not do, and how to tell us when we are wrong.
What this is
Free, animated guides to the web vulnerabilities people building with AI tools run into most, explained with one analogy: your app is a bank. It is a companion to isitsecure, the open-source scanner, and most guides match something that scanner looks for. The five in the last room, The New Hire, are about AI tools themselves and are not scanner checks.
How a guide is made
The guides, animations and quiz questions were drafted with AI assistance. Drafting is the easy part, so the work that matters is the checking.
How we check the facts
- Every incident, statistic, version number, named setting and default behaviour was checked against a page that was actually opened and read, not recalled from memory.
- Each guide lists those pages under Where this comes from, with what each one backs up, and the date the guide was last checked.
- Where a source could not support a claim, the claim was removed or softened. Several incidents were rewritten or dropped this way.
- Code samples were reviewed for the mistakes they warn about, because a “safe” example that is itself unsafe is worse than none.
- Source links can be re-checked in bulk, so a link that disappears is caught.
Independent review
These guides have not yet been reviewed line by line by an independent security specialist. The checking above is against published sources, which is not the same thing. If you do this for a living and would like to review a guide, we would welcome it. Here is what that involves.
What this is not
- It is not a security audit or a penetration test, and nothing here replaces one for an app that holds real customer data.
- The stories and animations are simplified on purpose. The bank is an analogy, and the analogy has limits.
- Code samples show an idea in one stack. Test them in yours before relying on them.
- Security advice goes out of date. Check the “Reviewed” date on a guide before acting on a version number or a default.
Found a mistake?
Every guide has a Report a correction link that opens a pre-filled issue on the public isitsecure repository, or you can open one directly. A source that supports your correction makes it much quicker to fix.
Privacy
The site has no accounts and no analytics. Your progress, ticked checklist items and theme are stored only in your own browser. The text fonts are loaded from Google Fonts.
Where to go next
Browse all guides, follow the guided path, or see how the scanner works.