An exposed API key in a frontend bundle is a secret credential — a Stripe secret key, a Supabase service-role key, an OpenAI key, a cloud provider key — that got compiled into the JavaScript a browser downloads, instead of staying server-side. Anyone can open your site's network tab, view the bundled .js files, and read the key in plain text. AI app builders make this common because generated code often calls third-party APIs directly from client components using an environment variable that was never meant to be public.

Security headers are HTTP response headers that tell the browser how to treat your page defensively — which scripts are allowed to run, whether the page can be loaded inside a frame, whether HTTPS is mandatory. When they're missing, the browser falls back to permissive defaults, which opens the door to attacks like cross-site scripting, clickjacking, and protocol downgrade that the header would otherwise have blocked outright.

A dangerous CORS misconfiguration is when a server responds with Access-Control-Allow-Origin set to "*" or reflects back whatever Origin header the requester sent, while also setting Access-Control-Allow-Credentials: true. That combination lets any website make an authenticated, cookie-bearing request to your API from a visitor's browser and read the response — effectively letting any third-party site act as a logged-in user against your backend.

An exposed source map is a .map file, publicly reachable next to a production JavaScript bundle, that maps the minified code back to its original, unminified source — including original file names, function and variable names, and code comments. If a production deploy ships .map files publicly, anyone can reconstruct something very close to your original source code, not just the compiled output.

If a deployed app's .env file or .git directory is reachable at a public URL, anyone can download it directly — no exploit required, just a GET request. A public .env file typically contains every secret the app uses in one place (database URLs, API keys, signing secrets), and a public .git/config or .git directory can expose your full commit history, including secrets that were committed and later "removed" but still exist in prior commits.

SPF and DMARC are DNS TXT records that tell mailbox providers which servers are allowed to send email as your domain, and what to do with messages that fail that check. Without them, nothing stops anyone from sending an email that appears to come from your domain — no server compromise required, just a mail server willing to set an arbitrary "From" address, which is how most business-email-compromise and phishing-as-your-brand attacks work.

A subdomain takeover happens when a DNS record — typically a CNAME — still points a subdomain (like app.yourcompany.com) at a third-party service (GitHub Pages, Heroku, an S3 bucket, Netlify, and similar), but the corresponding resource on that service was deleted or never claimed. Anyone can then register that same resource on the third-party service and have it start serving content on your subdomain, under your domain name, with your DNS still pointing at it.

HttpOnly, Secure, and SameSite are cookie flags that restrict how a browser is allowed to handle a cookie. A session cookie missing HttpOnly can be read by any JavaScript running on the page — including injected malicious scripts — and stolen outright. Missing Secure means the cookie can be sent over plain, unencrypted HTTP. Missing SameSite makes the cookie easier to leverage in cross-site request forgery, since it will be sent along with requests originating from other sites.