Guides
Plain-English security for people who build with AI. When a guide says to scan, that is the free check on the homepage. For the exact behavior of the free scan, read how it works.
Supabase RLS checklist for Lovable, Bolt, and Cursor apps
A practical Row Level Security checklist for Supabase apps built with Lovable, Bolt, or Cursor: grants, real policy SQL, how to test as a stranger, and what a passive scan cannot see.
Bolt shows your Supabase URL and API key. Is that a leak?
Seeing a Supabase URL and API key in a Bolt app's network tab is often normal. Here is how to tell a publishable anon key from a service_role secret, and what to do in each case.
Supabase service_role key exposed? What it means and how to fix it (fast)
Found your Supabase service_role key in your frontend? Here's why it's critical, how to check, and the exact steps to rotate it and move it server-side.
Lovable app security check: the 7 things to verify before launch
A practical security checklist for apps built with Lovable (and Bolt or v0): leaked keys, Supabase RLS, .env exposure, headers and SSL — plus a free automated check.
Is my vibe-coded app secure? A 10-minute self-check
Built your app with AI? Here's how to tell if it's secure: what attackers look at first, how to check it yourself in 10 minutes, and what an automated scan can and can't tell you.