https://tuvio.dev/blog Practical security guides for apps built with AI: what tends to go wrong, how to check your own, and what to change. en Mon, 19 Oct 2026 00:00:00 GMT https://tuvio.dev/blog/accidentally-pushed-env-file-to-github Accidentally pushed .env file to GitHub? Deleting it doesn't take the keys back. Rotate first, check logs, stop tracking it, then decide on history. https://tuvio.dev/blog/accidentally-pushed-env-file-to-github Mon, 19 Oct 2026 00:00:00 GMT Leaked keys and secrets https://tuvio.dev/blog/hide-api-key-in-frontend How to hide an API key in frontend code? You can't. Anything the browser loads is readable. Which keys can be public, and the small proxy that fixes the rest. https://tuvio.dev/blog/hide-api-key-in-frontend Mon, 19 Oct 2026 00:00:00 GMT Leaked keys and secrets https://tuvio.dev/blog/how-to-fix-npm-vulnerabilities How to fix npm vulnerabilities in the right order: see which ones ship, fix what attackers already exploit first, and skip the npm audit fix --force panic. https://tuvio.dev/blog/how-to-fix-npm-vulnerabilities Mon, 19 Oct 2026 00:00:00 GMT Vulnerable packages https://tuvio.dev/blog/is-lovable-safe Is Lovable safe? The platform mostly is. The app you built is your job. What CVE-2025-48757 exposed, what Lovable scans, and a pre-launch check. https://tuvio.dev/blog/is-lovable-safe Mon, 19 Oct 2026 00:00:00 GMT AI-built apps https://tuvio.dev/blog/stripe-webhook-signature-verification Stripe webhook signature verification stops fake payment events. Correct Next.js and Express code, the fail-open mistakes, and fixing 'verification failed'. https://tuvio.dev/blog/stripe-webhook-signature-verification Mon, 19 Oct 2026 00:00:00 GMT Payments and webhooks https://tuvio.dev/blog/supabase-anon-key-safe Is the Supabase anon key safe in your frontend? Yes, it is meant to be public. What it can reach is up to RLS and grants. Check your project in 5 minutes. https://tuvio.dev/blog/supabase-anon-key-safe Mon, 19 Oct 2026 00:00:00 GMT Supabase https://tuvio.dev/blog/supabase-rls-disabled-in-public Supabase RLS disabled in public means anyone with your public key can read that table. How to check, enable RLS and add policies without breaking the app. https://tuvio.dev/blog/supabase-rls-disabled-in-public Mon, 19 Oct 2026 00:00:00 GMT Supabase https://tuvio.dev/blog/supabase-rls-policy-examples Copy-paste Supabase RLS policy examples for owner-only rows, public reads and teams, plus five policy mistakes that quietly let any user read every row. https://tuvio.dev/blog/supabase-rls-policy-examples Mon, 19 Oct 2026 00:00:00 GMT Supabase https://tuvio.dev/blog/supabase-service-role-key The Supabase service role key bypasses every RLS policy. Where it is safe to use, how to check your build for it, and what to do if it leaked. https://tuvio.dev/blog/supabase-service-role-key Mon, 19 Oct 2026 00:00:00 GMT Supabase https://tuvio.dev/blog/vibe-coding-security-checklist A vibe coding security checklist ordered by damage: database rules, leaked keys, webhooks, exploited packages, AI output. A 2-minute check and a fix for each. https://tuvio.dev/blog/vibe-coding-security-checklist Mon, 19 Oct 2026 00:00:00 GMT Before you launch