Guides
Plain-English guides to shipping AI-built apps without the common security mistakes.
0102030405
Is your Supabase database exposed? How to check Row Level Security
Your anon key is public by design. Check that Row Level Security protects every table in a Lovable, Bolt or Cursor app.
How to check if your AI-built app leaks API keys
Find secrets committed to your repo or shipped to the browser, and what to do when you find one.
A security checklist for vibe-coded apps
The common, high-impact mistakes AI tools make, in the order worth fixing them.
Fixing npm audit vulnerabilities in plain English
What npm audit output means, which findings matter, and how to fix them without breaking your app.
What to check before launching a Cursor, Lovable or Bolt app
A pre-launch pass for AI-built apps: secrets, database access, auth, dependencies and basics.