Blog
Security notes for vibe-coded apps
Practical notes for people shipping with Lovable, Bolt, Replit, and the other AI builders. Each one says what a free public check can see, and what you still have to confirm in the dashboard.
How to check if your Supabase anon key is exposed (and why RLS matters)
The Supabase anon key belongs in the browser. Here's how to tell it from a secret key, and why row-level security is the real lock.
Supabase Row Level Security for vibe coders: a plain-English guide
Grants, policies, and the anon role, explained without assuming you write SQL every day. Includes a hand check and a prompt you can paste.
Firebase security rules mistakes in AI-built apps
Open rules, test mode, and a public Firebase API key. What the Firebase docs say to fix, and what a public page check can see.
Are API keys in my frontend safe? (OpenAI, Stripe, and other keys in client bundles)
Some keys are designed for the browser. OpenAI, Anthropic, and Stripe secret keys are not. How to tell, and what a public check looks for.
Security headers explained: CSP, HSTS, X-Frame-Options for non-engineers
What CSP, HSTS, X-Frame-Options, and the other common headers tell a browser, and when a missing header is a smaller issue than a leaked key.
Lovable vs Bolt vs Replit: security defaults compared
What Lovable, Bolt, and Replit document about secrets, databases, and publishing. Linked to each vendor's docs, with no score attached.
What to check before you launch a vibe-coded app: a 20-minute security pass
A short pass over keys, public files, database locks, and headers before you share the URL. Each step is something you can do on your own app.
Leaked .env, .git and source maps: how to find and fix them
How to tell a real public .env or .git folder from a false alarm, how source maps publish original code, and how to remove them.
Use the checklist when you want one list, or start from the guide for your builder. RSS