Guides

Practical fixes for common security mistakes in apps built with AI app builders.

• How to check if your Lovable/Supabase app is leaking data

  A step-by-step check you can do in 15 minutes: find your Supabase keys, see which tables have Row Level Security off, test what an anonymous visitor can read, and spot leaked secret keys.

• How to enable Row Level Security in Supabase (with copy-paste policies)

  Turn on RLS and add the right policies for the common cases — owner-only rows, public read, profiles, teams, insert-only forms and storage — plus the gotchas that quietly re-open your data.

• Is my Supabase anon key safe to expose? (Yes — here's what actually protects your data)

  Yes, the Supabase anon (publishable) key is meant to be public. What protects your data is Row Level Security. Here's how to check and fix it.

• How to find leaked API keys in your vibe-coded app's JavaScript bundle

  Anything in your frontend bundle is public. Here's how to search your Lovable, Bolt, v0 or Cursor app's JavaScript for secret keys — and fix a leak.

• Firebase security rules for vibe-coded apps: lock down Firestore and Storage

  Your Firebase API key is public by design; Security Rules protect your data. Copy-paste Firestore and Storage rules for apps built with AI tools.

• Lovable security checklist: 12 things to check before you launch

  A 12-point security checklist for Lovable apps before launch: scans, RLS, secrets, storage, admin pages, auth, payments and re-checking after AI edits.