Security guides for vibe-coded apps

Short, practical fixes for the problems we see most in apps built with Lovable, Bolt, Replit, v0, Cursor, Supabase and Firebase. Each guide explains what is going wrong, how to check it yourself, and the exact SQL, rules or prompt to fix it. Want to know which of these apply to your app? Run the free scan.

Subscribe via RSS.

• Firebase "security rules are defined as public": how to fix it

  Got the Firebase email saying your Firestore or Realtime Database rules are public or test mode is expiring? Here is what it means and the rules to replace them with, step by step.

• How to hide your OpenAI API key in a Lovable, Bolt or React app

  Calling OpenAI directly from the browser exposes your API key to every visitor. Here is how to move the call into a Supabase Edge Function or server route, add auth and limits, and rotate the old key.

• CVE-2025-48757 explained: is your Lovable app exposing data?

  What CVE-2025-48757 is, why it affected many Lovable apps built on Supabase, how to check whether your app is still exposed, and the RLS fixes to apply today.

• Is the Supabase anon key safe to expose? (publishable key explained)

  Your Supabase anon or publishable key is visible in your frontend, and that is by design. Here is when it is safe, when it is not, and how to check that Row Level Security is doing its job.

• Supabase "RLS Disabled in Public" warning: how to fix it

  Supabase's Security Advisor flags tables with Row Level Security off as an error. Here is what the warning means, how to find every affected table, and the SQL to fix it without breaking your app.

• Supabase RLS policy examples: copy-paste SQL for common tables

  Practical Supabase Row Level Security policy examples for user-owned rows, public read, teams, admins and insert-only tables, with the mistakes to avoid and how to test each one.

• Supabase "Security Definer View" warning: fix views that bypass RLS

  Why Supabase flags views as security definer, how a view can expose rows that Row Level Security protects, and the one-line security_invoker fix, plus security definer functions.

• Supabase service_role key exposed? How to rotate it safely

  What to do if your Supabase service_role or secret key leaked into frontend code or a public repo: how to confirm it, rotate it with the new API keys, and keep it server-side for good.

• Supabase storage bucket security: public vs private, done right

  How Supabase Storage public and private buckets really work, how files leak, and the storage.objects policies and signed URLs that keep user uploads private.

• VITE_ environment variables are public: what never to put in them

  Variables with VITE_, NEXT_PUBLIC_, EXPO_PUBLIC_ or REACT_APP_ prefixes are baked into your browser bundle. Learn which values are safe there, how to check your build, and where secrets belong instead.

• Lovable security checklist: 10 checks before you launch

  A practical security checklist for apps built with Lovable and Supabase: RLS, exposed keys, public files, auth settings and headers, with copy-paste fixes.

• Is my Lovable app secure? How to check in 5 minutes

  How to tell whether your Lovable app is leaking data: what to look for in your Supabase tables, JS bundles and public files, and a free read-only scan.

• Supabase RLS checker: find tables anyone can read

  Check whether your Supabase tables are readable with the public anon key. Learn what RLS does, how to test it safely, and the SQL to fix open tables.

• Exposed API key in JavaScript: how to find and fix it

  How secret API keys end up in frontend JavaScript bundles, how to find them, and how to move them server-side and rotate them safely.

• Bolt.new security scan: free check for your Bolt app

  Run a free, read-only security scan on an app built with Bolt.new: exposed keys, open Supabase tables, public files and missing headers, with fix prompts.