For people who build with AI

You built it with AI. Do you know what it’s hiding?

Codewright teaches the fundamentals AI skips, security, how your app actually works, and how to read the code you didn’t write. Built by an instructional designer, not a chatbot.

Scan your app, free →What you’ll learn

Paste your code, see your holes · nothing leaves your browser

Chat.tsxshipped ✓
1// components/Chat.tsx
2const client = new OpenAI({
3 apiKey: "sk-proj-a83f...c091",
4 dangerouslyAllowBrowser: true,
5})
🔍Your key ships to every visitor's browser. Do you know if yours does?
Not a chatbot
designed by an instructional designer
Grasp → Apply → Understand
a real teaching method
Hands-on
find & fix real holes, in-browser
Free to start
the whole field guide, no account

It works. That’s not the same as safe.

You shipped an app you can’t fully read. Three questions most vibe-coded apps fail, and none of them show up until real users, and real data, arrive.

Is your API key in the browser?

If the AI put it in your frontend, anyone can open DevTools and read it. That surprise $2,000 bill was someone else spending on your key.

Does your app actually have auth?

“Logged in” in the UI isn't the same as the server checking who you are. If the check is client-side, it's not a lock. It's a suggestion.

Would you even know?

The AI told you it works. It didn't tell you what it left open. Nobody ran the checklist a real engineer runs before shipping.

Anatomy of a leak

This is your app. Here’s where it leaks.

Every app you vibe-coded is really these three pieces. Hover a red marker to see what leaks there, and how to close it.

Your browserwhat every visitor runs{ }route.tsYour serveryour API routesYour databaseevery user’s dataREQUESTQUERYRESPONSE · YOUR DATA COMES BACK1Key in the browser2No auth check3SQL injection4Public / no RLS5Leaking fields
Hover or tap a red marker above to see what leaks there, and how an engineer closes it.
What you’ll be able to do

Four rungs, from scared to in control.

1
Understand what you built

Point at any file and know what it does. Client vs. server, APIs, the database, where auth lives, the map of your own app.

2
Don't get hackedFlagship · start here

Find an exposed secret, a missing auth check, or an open database before an attacker does, and close it yourself.

Open the flagship module →
3
Read & fix the AI's code

Read code you didn't write, catch the AI when it's confidently wrong, and fix what breaks without guessing.

4
Actually learn to codeGo deeper

Ready to write it yourself? Ten full language courses, Python to Rust, the durable path, when you want it.

The flagship module · live now

Is Your App Leaking?

A real, finished course. You’ll watch a vibe-coded app get breached through an exposed key, then find and fix that same hole in a sample repo, before learning the checklist that would have caught it. Not a lecture. A dry run.

Exposed secrets & API keysMissing or broken authClient-side “security” that isn'tSQL injection & the ORM mythPublic database / no RLSData leaking in API responses
Open the module →
1GraspSee a real vibe-coded app get breached, the actual damage, concretely, before any theory.
2ApplyFind the hole in a sample repo and plug it yourself. Hands-on first, the way it sticks.
3UnderstandWhy it happens (AI optimizes for “it works,” not “it's safe”) and the checklist to run every time.

Built by a teacher, not a tutorial mill.

Every module is designed by a professional instructional designer, someone whose actual job is making hard things click. That’s why it’s concrete first: you feel a concept and use it before anyone explains it, because that’s the order the brain actually learns in. No AI slop. No 40-tab rabbit hole. One method that sticks.

Rung 4 · go deeper

Ready to write it yourself?

When you want to stop directing the AI and start writing the code, ten full language courses are waiting, same teaching method, from your first line to real fluency.

Python
Web
SQL
TSTypeScript
Swift
Godot
Java
C
Rust
GoGo

Find out what your app is hiding.

Start the security module free, no account, no card. Upgrade to Pro ($9/mo) only when you want unlimited AI review of your own fixes.

Scan your app, free →See pricing