Guides
Security guides for AI-built apps
Clear steps for the problems that actually show up, with commands you can run on your own site.
Something went wrong
Is Lovable safe for real users?
Lovable can power a real product, but your app's safety depends on its database rules and keys. Here's what to check before real people sign up.
Is it safe to expose the Supabase anon key?
The Supabase anon key is designed to be public, but only if row-level security is on. Learn what the key can really do and how to test your tables.
Supabase service role key exposed: what to do now
A leaked Supabase service role key bypasses row-level security. Follow these steps to replace it, check your data and keep it off the front end.
Supabase row-level security is off: how to fix it
If row-level security is off, your public key may read whole tables. Find open Supabase tables with one query and fix them with simple policies.
Is my Firebase database public?
Firebase config is public, so your security rules do the real work. Test Realtime Database and Firestore for open access and lock them down.
Stripe secret key exposed: what to do now
If your sk_live key leaked, roll it in the Stripe dashboard, check recent activity and move it to server code. Here's the order to do it in.
OpenAI API key leaked: what to do now
A leaked OpenAI key can run up your bill fast. Delete it, check your usage, set limits and move AI calls behind your own server.
Is your .env file exposed?
A public .env file can hand over every key your app uses. Test yours in seconds, remove it from your site and replace every secret inside.
Exposed .git folder: how to check and fix it
A public .git folder can let strangers rebuild your source code and old secrets. Test your site and block it with one server rule.
VITE_ and NEXT_PUBLIC_ variables are public
Anything named VITE_, NEXT_PUBLIC_ or REACT_APP_ is built into browser code. Find secrets in those variables and move them to the server.
Vibe coding security checklist: 12 checks before you launch
Built your app with AI? Use this plain-English security checklist before launch, covering keys, databases, files, logins, email and monitoring.
I think my app was hacked: what to do first
Think your AI-built app was breached? Keep evidence, cut off access, replace keys, check for damage and find out who you may need to tell.
Exposed source maps: how to check and turn them off
Production source maps can hand strangers your original code and comments. Check whether yours are public and switch them off in Vite or Next.js.
CORS misconfiguration: how to test your API
A loose CORS setup can let other websites read data from signed-in users. Test your API with one command and learn the safe settings.
SPF and DMARC: stop fake email from your domain
Without SPF and DMARC, strangers can send email that looks like it came from you. Check your records and set them up safely, step by step.
Supabase storage bucket public: how to protect your files
Files in a public Supabase bucket can be opened by anyone with the link. Check your buckets, make private files private and use signed URLs.
Security headers for AI-built apps: what to set
A plain-English guide to HSTS, Content-Security-Policy and other security headers, with a one-line test and safe starting values.
Scanners by tool
Security scanner for Lovable apps
Scan your Lovable app for open Supabase tables, exposed API keys and public files. Get a clear report and fix prompts to paste back into Lovable.
Security scanner for Bolt apps
Check your Bolt.new app for exposed API keys, open databases and leaked files. Plain-English results and prompts you can paste into Bolt.
Security scanner for apps built with Cursor
Built your app with Cursor? Scan the live site for exposed secrets, open endpoints, leaked files and weak security headers.
Security scanner for Replit apps
Scan your Replit deployment for leaked keys, open API addresses, exposed files and missing security settings.
Security scanner for apps built with v0
Check apps built with v0 for exposed keys, NEXT_PUBLIC settings that hold secrets, open API routes and weak headers.
Security scanner for apps built with Windsurf
Scan apps built with Windsurf for exposed API keys, open data and leaked files, with plain-English fixes.
Security scanner for Base44 apps
Check your live Base44 app for exposed keys, open addresses and weak security settings.
Supabase RLS checker
Find out whether your Supabase tables can be read with your public key. Checks row-level security from the outside, plus storage buckets and email confirmation.
Firebase security rules checker
Test whether your Firebase Realtime Database, Firestore and Storage can be read without signing in.
Exposed API key scanner
Scan your website's public code for leaked Stripe, OpenAI, Anthropic, AWS, GitHub and database credentials before someone else finds them.