Guides
Security guides for vibe-coded apps
Each guide covers the mistakes that show up with that builder, a way to check them by hand, and a prompt you can paste back into the tool. They describe only what a public check can see: the page, its scripts, a short list of paths such as .env and .git, and Supabase or Firebase when that config is already public. They do not claim a penetration test, a customer count, or a result we did not measure.
The check does not log in, guess passwords, or use a secret it finds. A quiet result is an early warning that came back clean. If you want one list for any stack, use the vibe-coded app security checklist.
Is my Lovable app secure?
Service role keys, row-level security, and variables that ship to the browser.
Is my Bolt app secure?
Vite variables, Supabase locks, and Bolt Database access you confirm by hand.
Is my Replit app secure?
Secrets in the page, a public Repl, and DATABASE_URL where a visitor can read it.
Is my Cursor app secure?
Client env prefixes, row-level security, Firebase test mode, and source maps.
Is my v0 app secure?
Next.js client bundles, Vercel env vars, and optional Supabase or Neon.
Is my Base44 app secure?
Entity rules you check by hand, plus Vite secrets and service-role calls.
Is my Windsurf app secure?
Agent edits that ship a secret, loosen a database rule, or publish a source map.
Is my Bubble app secure?
Privacy rules, API Connector secrets, and the Data API admin token.
Start with the vibe-coded app security checklist if you want one list that works for any stack. Longer notes live on the blog.