A Security Update from Build This Now

One of our customers flagged something suspicious in their project. We investigated, found a security issue in a file we ship with the SaaS skeleton, fixed it, and updated the skeleton the same day.

This post explains what happened in plain terms, how to check your copy, and how the framework keeps your projects protected going forward.

What happened

Here is the simplest way to explain a supply chain attack.

Imagine a config file that is normally 8 lines long. Small, boring, never changes. Your project uses it every time you run the app locally. Nobody reads it. Why would you?

An attacker found that file. They added a hidden chunk of malicious code at the very end of the last line, after hundreds of blank spaces. In any code editor, the file still looked like 8 lines. You would have to scroll horizontally past a wall of whitespace to see it.

That is a supply chain attack. They do not break into your app. They hide inside something your app already trusts and runs automatically.

A customer noticed something was off. They reported it. We investigated immediately and fixed it that same day.

What to do

The SaaS skeleton is delivered by cloning a GitHub repository. If you cloned it recently, check one file: webapp/postcss.config.mjs. It should be short. Under 10 lines. Nothing unusual at the end.

Not sure what you are looking at? Reach out at buildthisnow.com or DM on X. We will check your installation with you directly.

How your projects stay protected

A customer caught this one. Going forward, the framework catches it automatically.

Build This Now ships with three commands that run security checks on a schedule.

/security scans your project for vulnerabilities. Config files, auth logic, database rules, exposed secrets. Critical findings send you an email immediately.

/audit checks your dependencies and build files for anything unexpected or out of place.

/monitor keeps both of these running in the background automatically, even when you are not working. Run it once:

/monitor --defaults

After that, checks happen on their own. You get notified when something needs attention.

Going forward

We are running these checks more frequently on our own distribution chain now. The tools were already there. We are using them more aggressively.

Supply chain attacks are an industry-wide problem. The response is not paranoia. It is automated checks running continuously so issues surface fast.

The skeleton is clean. The framework is clean. If you have questions, reach out at buildthisnow.com or DM on X.