Guides
Security guides for apps built with AI
Straight answers to the questions vibe coders ask before launch. Each guide links its sources and ends with prompts you can paste into Cursor, Claude Code, Lovable, Bolt, Replit or v0.
Is my Supabase anon key exposed? What's safe to show and what isn't
Why the anon key being public is fine, why a missing RLS policy isn't, and how to check your tables.
Read the guide →Lovable, Bolt, Replit and v0 app security checklist before launch
A one-afternoon checklist: secrets, database rules, logins, admin pages, payments and headers.
Read the guide →Is my API key exposed in my JavaScript? VITE_ and NEXT_PUBLIC_ explained
Why VITE_ and NEXT_PUBLIC_ variables are public, how to check your bundle, and how to move secrets server-side.
Read the guide →Security headers for vibe-coded apps: copy-paste Netlify and Vercel configs
Ready-to-paste _headers, vercel.json and next.config.js configs, and how to roll out CSP safely.
Read the guide →Firebase security rules mistakes in AI-built apps (and how to fix them)
Test mode, "any logged-in user" rules, self-assigned roles and open Storage, with safe rule examples.
Read the guide →