Blog
Practical security guides for apps built with AI: what tends to go wrong, how to check your own, and what to change.
Supabase
- Is the Supabase Anon Key Safe? Yes, If Every Table Has RLS
Is the Supabase anon key safe in your frontend? Yes, it is meant to be public. What it can reach is up to RLS and grants. Check your project in 5 minutes.
- Supabase RLS Disabled in Public: What It Means and How to Fix It
Supabase RLS disabled in public means anyone with your public key can read that table. How to check, enable RLS and add policies without breaking the app.
- Supabase RLS Policy Examples, Plus 5 Mistakes That Leak Data
Copy-paste Supabase RLS policy examples for owner-only rows, public reads and teams, plus five policy mistakes that quietly let any user read every row.
- Supabase Service Role Key: Where It Belongs and What If It Leaks
The Supabase service role key bypasses every RLS policy. Where it is safe to use, how to check your build for it, and what to do if it leaked.
Leaked keys and secrets
- Accidentally Pushed .env File to GitHub? Fix It in This Order
Accidentally pushed .env file to GitHub? Deleting it doesn't take the keys back. Rotate first, check logs, stop tracking it, then decide on history.
- How to Hide an API Key in the Frontend: The Honest Answer
How to hide an API key in frontend code? You can't. Anything the browser loads is readable. Which keys can be public, and the small proxy that fixes the rest.
Vulnerable packages
- How to Fix npm Vulnerabilities Without Breaking Your App
How to fix npm vulnerabilities in the right order: see which ones ship, fix what attackers already exploit first, and skip the npm audit fix --force panic.
AI-built apps
- Is Lovable Safe? The Platform, Your App, and What to Check
Is Lovable safe? The platform mostly is. The app you built is your job. What CVE-2025-48757 exposed, what Lovable scans, and a pre-launch check.
Payments and webhooks
- Stripe Webhook Signature Verification: Do It, and Fail Closed
Stripe webhook signature verification stops fake payment events. Correct Next.js and Express code, the fail-open mistakes, and fixing 'verification failed'.
Before you launch
- Vibe Coding Security Checklist: 12 Checks Before You Launch
A vibe coding security checklist ordered by damage: database rules, leaked keys, webhooks, exploited packages, AI output. A 2-minute check and a fix for each.