Guides

Security guides for AI-built apps

Practical, plain-language guides for people shipping apps with Lovable, Bolt, Replit, v0, Cursor, Claude and Codex. Each one explains what can go wrong and how to check it yourself.

• Is my Lovable app secure?

  How to check whether your Lovable app leaks data: Supabase Row Level Security, secret keys in the frontend, storage buckets, edge functions and admin checks, with what to fix first.

• Supabase RLS checker: check Row Level Security yourself

  What Supabase Row Level Security is, SQL queries to find tables without RLS and risky policies, how to test from the outside with the anon key, and the most common RLS mistakes.

• Bolt app security checklist

  A launch checklist for apps built with Bolt.new: secret keys, Supabase RLS, storage, auth settings, edge functions, AI calls, admin checks, source maps, .env files and security headers.

• Exposed API keys in frontend code: which are fine, which are not

  VITE_, NEXT_PUBLIC_ and similar variables end up in every visitor's browser. Which keys are designed to be public (Supabase anon, Stripe publishable, Firebase config) and which must never be there, and what to do if one leaked.

• Firebase security rules check

  How to check Firebase Security Rules for Firestore, Realtime Database and Cloud Storage: spotting test-mode rules, testing from outside, safe rule patterns and common mistakes.