Your AI shipped a backend that boots. That is the whole problem.

AI-generated backend code tends to pass tests while shipping serious security vulnerabilities by default — unbounded body sizes, wildcard CORS with credentials, SSRF-prone fetch calls, and missing auth. The author argues the fix isn't more vigilance but inverting defaults so the safe path is the easy path. Using DaloyJS (their own TypeScript framework) as a concrete example, they demonstrate secure-by-default patterns: hard body limits, SSRF-guarded fetch that re-validates redirects, refuse-to-boot on wildcard CORS in production, weak session secrets, and unauthenticated state-changing routes. JWT algorithm confusion attacks are closed by construction. Supply chain risks are addressed via zero runtime dependencies, npm provenance, SBOMs, and pnpm settings that block scripts and enforce a 24-hour package release age. The post honestly acknowledges limitations: broken object-level authorization still requires correct developer logic, and DaloyJS is a new beta with a smaller ecosystem than Express or Fastify.