Security, explained for people who ship
Plain-English security guides for apps built with AI. Every one has a two-minute check you can run yourself and a copy-paste prompt that fixes the problem.
Lovable
What Lovable gets wrong, gap by gap.
Guide3 minIs Lovable safe? What it gets wrong, and how to checkA real CVE exposed 303 endpoints across 170+ Lovable apps. Here are the six gaps Lovable leaves behind, and how to check yours.Lovable3 minLovable and Supabase RLS: is your database public?The gap behind CVE-2025-48757. Your anon key is public by design — RLS is the only thing standing between it and your user table.Lovable3 minLovable: can a script steal your users' logins?A session token in localStorage is readable by any script on the page. Here is how to check where yours lives.Lovable3 minLovable: files you deployed by accidentBots request /.env on every new domain within hours of it going live. Here is how to find out what yours answers with.Lovable3 minLovable: how API keys end up in your frontendNot every key in your bundle is a problem. Two of them are. Here is how to tell the difference and get the dangerous ones out.Lovable3 minLovable: the security headers you are missingSix headers, no code changes, and they turn several classes of bug from serious into harmless.Lovable3 minLovable: your admin page is hidden, not protectedIf the only thing stopping a stranger reaching /admin is that you did not link to it, you do not have access control.
Supabase
RLS, keys, and how to verify them from outside.
How to check3 minHow to check if your Supabase RLS actually worksChecking that a policy exists is not the same as checking that it denies anything. Test it the way an attacker would.How to check3 minSupabase service_role key exposed: how to check and fixThere are two Supabase keys. One is meant to be public. The other bypasses all your security — and they look almost identical.
A key leaked
Something is already out. Start here.
Key leaked3 minAWS access key leaked: what to do right nowBots find these in minutes and spin up compute on your account. Speed matters more here than anywhere else.Key leaked3 minFirebase Admin key leaked: what to doThe Firebase apiKey in your frontend is fine. A service account JSON is the opposite of fine.Key leaked3 minOpenAI API key leaked: what to do right nowRotate first, investigate second. Here is the order that limits the damage.Key leaked3 minStripe secret key leaked: immediate stepsThis one touches real money and real customer data. Roll the key before you read the rest.Key leaked3 minSupabase service_role key leaked: what to doThis key ignores all your security rules. It is the most serious key in the Supabase stack.
Fix prompts
Copy, paste into your AI, done.
Fix prompt3 minPrompt: actually protect your admin pagesTurns cosmetic role checks into enforcement that survives someone typing the URL directly.Fix prompt3 minPrompt: add rate limiting to your appWithout limits, your login is a password-guessing endpoint and your AI feature is someone else's free tier.Fix prompt3 minPrompt: add the security headers you are missingSix headers, no application changes, and a warning about the one that breaks sites.Fix prompt3 minPrompt: fix open Firebase security rulesTest mode expires, and what replaces it is often a rule that allows everyone forever.Fix prompt3 minPrompt: full checklist after a key leaksRotating the key is step one of five. The other four are where people stop too early.Fix prompt3 minPrompt: get API keys out of your frontendFinds every hardcoded key, separates the public-by-design ones from the real secrets, and relocates the rest.Fix prompt3 minPrompt: move sessions out of localStorageA token in localStorage is readable by every script on the page, including one that got there by accident.Fix prompt3 minPrompt: stop shipping source maps to productionSource maps turn your minified bundle back into commented source. Anyone can download them.Fix prompt3 minPrompt: stop users reading each other's dataThe most common serious bug in AI-built apps: /orders/1041 works, and so does /orders/1042.Fix prompt3 minPrompt: turn on Supabase Row Level Security properlyEnables RLS everywhere and — importantly — catches the USING (true) policies that pass naive checks.
Errors explained
What the message means — and when it means you're safe.
Error explained3 min"blocked by CORS policy" — what it means and how to fix itCORS is not in your way by accident. The one-line fix people reach for removes the protection entirely.Error explained3 min"Missing or insufficient permissions" in Firebase — what it meansFirestore is denying the request on purpose. The wrong fix here opens your whole database.Error explained3 min"Mixed Content: The page was loaded over HTTPS" — what it meansOne insecure asset on a secure page — plus a warning about the directive that turns this into a blank site.Error explained3 min"new row violates row-level security policy" — what it meansGood news, badly worded: this error is your database refusing an unauthorised write.Error explained3 min"No 'Access-Control-Allow-Origin' header" — what to doA specific CORS failure: the response arrived with no permission header at all.Error explained3 min"Refused to execute inline script" — CSP explainedCSP is doing its job. The usual workaround removes the protection you just added.Error explained3 min401 vs 403: what the difference means for your appTwo codes people use interchangeably. The choice quietly tells attackers what exists.
Or just check your site
Every check in these guides, run against your live site from the outside. Free, about 30 seconds, no signup.
Check my site — free