Learn
Secure the app you built with AI.
14 in-depth guides for founders and the engineers who approve their changes. Each one answers a real question, shows code you can run against your own project, and links to the checks behind it. No sign-up.
Supabase database
Row level security, views, storage and Realtime: who can read what.
How to secure a Lovable app’s Supabase database
Find what anyone can read, fix it with a migration, and test it as a stranger, step by step.
6 MIN READSupabase RLS policies explained, with owner and stranger tests
USING vs WITH CHECK, the four commands, and SQL that tests each table as a visitor, a stranger and the owner.
4 MIN READSupabase views and security_invoker: stop views bypassing RLS
Why a view ignores your policies by default, and the one-line security_invoker fix.
4 MIN READSupabase storage bucket policies: public, private and per-user folders
Public vs private buckets, and storage.objects policies that give each user their own folder.
4 MIN READSupabase Realtime security: keep private rows out of subscriptions
Who receives database changes, why a loose read policy streams private rows, and the fix.
Auth and server code
Roles, Edge Functions and payment webhooks.
user_metadata vs app_metadata: where to store roles in Supabase
Users can edit user_metadata. Where roles belong instead, with policies and server code.
4 MIN READHow to secure Supabase Edge Functions
Verify the caller, use the service key safely, never trust ids from the body, and get CORS right.
4 MIN READVerify Stripe webhook signatures in a Supabase Edge Function
A working Deno function that verifies the signature, reads the raw body and handles retries.
Keys and incidents
Leaked keys, git history and the first hour after a leak.
Launch and other stacks
A pre-launch checklist, security headers, Firebase rules and npm dependencies.
Pre-launch security checklist for vibe-coded apps
Everything to check before real users arrive, in order, each item linked to a self-check and a fix.
4 MIN READFirebase security rules basics: lock down Firestore and Storage
Why test-mode rules leak, owner-only rules to copy, and emulator tests as visitor, stranger and owner.
6 MIN READSecurity headers for AI-built apps (Lovable, Bolt, Vercel, Netlify)
Six response headers, a copy-paste starter set for Vercel, Netlify, Cloudflare and Lovable, and how to test it.
4 MIN READHow to find and fix vulnerable npm dependencies
npm audit and OSV, deciding which advisories matter, and fixing them with upgrades and overrides.
Where to start
Three guides, in this order.
If you have an hour before launch, read these. They cover the problems that expose the most data in apps built with AI tools.
- RLS policies explained, with owner and stranger testsHow to know who can read each table, by testing it.
- Rotate a leaked key and clean your git historyWhy deleting the key isn't enough, and the order that works.
- Pre-launch security checklist for vibe-coded appsEverything else, as a list you can work through.
Free check
Rather have it checked for you?
Paste your public repo. You get every finding, the fix and the proof on one page.