Guides
Practical security for apps built with AI coding tools.
How to monitor your Supabase app for leaked keys and open RLS
How keys leak into frontend bundles, anon vs service_role, RLS and views, free tools like Supabase Security Advisor, and checking again after every deploy.
Supabase RLS for vibe-coded apps: how to check if your tables are public
Why AI-built Supabase apps often ship tables anyone can read, how to test it safely, and the SQL to fix it.
Exposed API keys in JavaScript bundles: what AI builders leak and how to fix it
Which keys are safe in frontend code, which ones are not (service_role, OpenAI, Stripe secret), and how to move them server-side.
Security headers for AI-built apps: CSP, HSTS and friends in 10 minutes
The six response headers every Lovable, Bolt, Cursor or Replit app should send, with copy-paste config.
The vibe coding security checklist (before and after every deploy)
A short pre-launch and per-deploy checklist for apps built with Lovable, Bolt, Cursor, Replit and v0.