Security, explained for people who ship
Plain-English security guides for apps built with AI. Every one has a two-minute check you can run yourself and a copy-paste prompt that fixes the problem.
Lovable
What Lovable gets wrong, gap by gap.
Guide3 minIs Lovable safe? What it gets wrong, and how to checkA real CVE exposed 303 endpoints across 170+ Lovable apps. Here are the six gaps Lovable leaves behind, and how to check yours.Lovable3 minLovable and Supabase RLS: is your database public?The gap behind CVE-2025-48757. Your anon key is public by design — RLS is the only thing standing between it and your user table.Lovable3 minLovable and the Supabase service_role key: how it leaksThe fastest way to make an RLS error disappear is to use the key that ignores RLS. Sometimes that is what your builder does.Lovable3 minLovable: can a script steal your users' logins?A session token in localStorage is readable by any script on the page. Here is how to check where yours lives.Lovable3 minLovable: files you deployed by accidentBots request /.env on every new domain within hours of it going live. Here is how to find out what yours answers with.Lovable3 minLovable: how API keys end up in your frontendNot every key in your bundle is a problem. Two of them are. Here is how to tell the difference and get the dangerous ones out.Lovable3 minLovable: the security headers you are missingSix headers, no code changes, and they turn several classes of bug from serious into harmless.Lovable3 minLovable: your admin page is hidden, not protectedIf the only thing stopping a stranger reaching /admin is that you did not link to it, you do not have access control.
Supabase
RLS, keys, and how to verify them from outside.
Guide3 minIs Supabase secure? What you are responsible forThe platform is not the weak part. The four settings you were never told about are.Guide3 minSecurity checks you can run on your own siteHands-on checks you can run from a browser or a terminal in two minutes each.How to check3 minHow to check if your Supabase RLS actually worksChecking that a policy exists is not the same as checking that it denies anything. Test it the way an attacker would.How to check3 minHow to check your Firebase security rules are not openFirebase starts your project in test mode: open to everyone, for 30 days. Plenty of apps ship before anyone notices.How to check3 minIs the Supabase anon key safe to expose in your frontend?The anon key is meant to be public. Whether that is safe depends entirely on a setting most people never open.How to check3 minSupabase anon key vs service_role key: the differenceBoth are long tokens starting eyJ. One is public by design; the other bypasses every security policy you have written.How to check3 minSupabase service_role key exposed: how to check and fixThere are two Supabase keys. One is meant to be public. The other bypasses all your security — and they look almost identical.How to check3 minWhat is Row Level Security, and why your app needs itWhen the browser talks to the database directly, the database is the only place left to enforce who reads what.
A key leaked
Something is already out. Start here.
Guide3 minAn API key leaked — what to do right nowRotate first, read second. The order matters more than anything else on this page.Key leaked3 minAWS access key leaked: what to do right nowBots find these in minutes and spin up compute on your account. Speed matters more here than anywhere else.Key leaked3 minFirebase Admin key leaked: what to doThe Firebase apiKey in your frontend is fine. A service account JSON is the opposite of fine.Key leaked3 minOpenAI API key leaked: what to do right nowRotate first, investigate second. Here is the order that limits the damage.Key leaked3 minStripe secret key leaked: immediate stepsThis one touches real money and real customer data. Roll the key before you read the rest.
Fix prompts
Copy, paste into your AI, done.
Fix prompt3 minPrompt: actually protect your admin pagesTurns cosmetic role checks into enforcement that survives someone typing the URL directly.Fix prompt3 minPrompt: add rate limiting to your appWithout limits, your login is a password-guessing endpoint and your AI feature is someone else's free tier.Fix prompt3 minPrompt: add the security headers you are missingSix headers, no application changes, and a warning about the one that breaks sites.Fix prompt3 minPrompt: fix open Firebase security rulesTest mode expires, and what replaces it is often a rule that allows everyone forever.Fix prompt3 minPrompt: full checklist after a key leaksRotating the key is step one of five. The other four are where people stop too early.Fix prompt3 minPrompt: get API keys out of your frontendFinds every hardcoded key, separates the public-by-design ones from the real secrets, and relocates the rest.Fix prompt3 minPrompt: move sessions out of localStorageA token in localStorage is readable by every script on the page, including one that got there by accident.Fix prompt3 minPrompt: stop shipping source maps to productionSource maps turn your minified bundle back into commented source. Anyone can download them.Fix prompt3 minPrompt: stop users reading each other's dataThe most common serious bug in AI-built apps: /orders/1041 works, and so does /orders/1042.Fix prompt3 minPrompt: turn on Supabase Row Level Security properlyEnables RLS everywhere and — importantly — catches the USING (true) policies that pass naive checks.
Errors explained
What the message means — and when it means you're safe.
Guide3 minError messages explained, in plain EnglishSeveral of these errors are protection doing its job. The obvious fix is often the one that opens a hole.Error explained3 min"Blocked by CORS policy" — what it means and how to fixCORS is not in your way by accident. The one-line fix people reach for removes the protection entirely.Error explained3 min"New row violates row-level security policy" — fixGood news, badly worded: this error is your database refusing an unauthorised write.Error explained3 min"Refused to execute inline script" — CSP explainedCSP is doing its job. The usual workaround removes the protection you just added.Error explained3 min401 vs 403: what the difference actually meansTwo codes people use interchangeably. The choice quietly tells attackers what exists.Error explained3 minFirebase: "Missing or insufficient permissions" fixFirestore is denying the request on purpose. The wrong fix here opens your whole database.Error explained3 minMixed Content error on HTTPS — what it means and fixOne insecure asset on a secure page — plus a warning about the directive that turns this into a blank site.Error explained3 minNo 'Access-Control-Allow-Origin' header — how to fixA specific CORS failure: the response arrived with no permission header at all.
Or just check your site
Every check in these guides, run against your live site from the outside. Free, about 30 seconds, no signup.
Check my site — free