Security guides
Methodology and fix patterns for the issues our passive scanner checks. Platforms covered: Lovable, Supabase, Bolt, Vite, Cursor, Next.js, v0, Vercel, Replit, Stripe, OpenAI, Anthropic, Netlify, Resend.
- Lovable + Supabase RLS Checklist Before You LaunchA practical Row Level Security checklist for Lovable apps backed by Supabase: enable RLS, write owner policies, lock down storage and test with the anon key.Lovable · Supabase
- Bolt.new: How to Fix Exposed API Keys in Your FrontendWhy API keys end up in Bolt.new client bundles, how to find them, and the server-side proxy pattern that fixes it.Bolt · Vite
- Cursor + Next.js: Environment Variable SecurityHow NEXT_PUBLIC_ works, why AI-generated Next.js code leaks server config, and how to enforce the server/client boundary with server-only.Cursor · Next.js
- Supabase service_role Key Leaked? Fix It in This OrderStep-by-step incident response for a leaked Supabase service_role or sb_secret_ key: rotate, remove from client, review access, and prevent recurrence.Supabase · Lovable · Bolt
- v0 + Vercel: Production Security HeadersAdd HSTS, CSP, X-Frame-Options and nosniff to a v0-generated Next.js app on Vercel using next.config headers or vercel.json.v0 · Vercel · Next.js
- Replit Secrets & Deployment Security ChecklistKeep API keys in Replit Secrets, out of client code and out of public Repls, and harden a Replit deployment before launch.Replit
- Supabase Storage Bucket Policies for Vibe-Coded AppsPublic vs private buckets, owner-scoped storage.objects policies and signed URLs — the storage settings to check before launch.Supabase · Lovable · Bolt
- Stripe Secret Key in Your Frontend: How to Fix ItIf sk_live_ is in your JavaScript bundle, here is how to roll it, move payments server-side with Checkout, and verify webhooks.Stripe · Bolt · Lovable · Cursor
- OpenAI API Key Exposed in the Browser: Fix and PreventWhy sk-proj- keys in client code get abused, how to proxy OpenAI calls safely, and the limits to set at the provider.OpenAI · Bolt · Lovable · Replit
- Anthropic API Key in Client-Side Code: What to DoDetect sk-ant- keys or ANTHROPIC_API_KEY values in your bundle, rotate them, and move Claude calls behind a server route.Anthropic · Cursor · Replit
- Vite Environment Variables: What Is Actually PublicHow Vite's VITE_ prefix and import.meta.env work, which values end up in your bundle, and how to keep secrets server-side.Vite · Lovable · Bolt
- NEXT_PUBLIC_ Pitfalls in AI-Generated Next.js AppsCommon ways NEXT_PUBLIC_ variables leak secrets in Next.js projects built with AI tools, and safe alternatives.Next.js · Cursor · v0
- Publicly Exposed .env File: Detection and FixHow .env files end up downloadable on production sites, how to test for it without false positives, and how to fix and rotate.Replit · Bolt · Cursor · Lovable
- Exposed .git Directory on Production: Fix GuideWhy a reachable /.git/config lets attackers rebuild your source code and history, and how to stop serving it.Replit · Cursor · Bolt
- Production Source Maps: Risk and How to Disable ThemWhat public .js.map files reveal, when they matter, and how to disable or privately upload them in Next.js and Vite.Next.js · Vite · v0 · Bolt
- Content-Security-Policy for Vibe-Coded AppsA starter CSP for React/Next.js/Vite apps built with AI tools, how to roll it out in report-only mode, and how to handle inline scripts.Lovable · Bolt · v0 · Cursor
- HSTS Setup on Vercel and NetlifyAdd Strict-Transport-Security on Vercel (vercel.json / next.config) and Netlify (_headers), choose a max-age and decide on preload.Vercel · Netlify · v0 · Bolt
- CORS Wildcards and Origin Reflection: Fix GuideWhen Access-Control-Allow-Origin: * is fine, when origin reflection with credentials is dangerous, and how to write an allowlist.Cursor · Replit · Bolt
- Is the Supabase Anon Key Safe to Expose?What the anon/publishable key can and cannot do, how it differs from service_role and sb_secret_ keys, and what actually protects your data.Supabase · Lovable · Bolt
- Lovable Pre-Launch Security ChecklistTen checks to run on a Lovable app before you share it: keys, Supabase RLS, storage, edge functions, headers and auth settings.Lovable · Supabase
- Bolt.new + Supabase Auth HardeningLock down sign-up, redirect URLs, session handling and per-user data access in a Bolt.new app using Supabase Auth.Bolt · Supabase
- Security Review Checklist for Cursor-Generated CodeA focused review checklist for code written with Cursor: secrets, authz on every route, input validation, dependency hygiene.Cursor
- Hardening an App Built with Replit AgentPost-generation hardening steps for Replit Agent apps: secrets, database access, auth checks, static serving and headers.Replit
- Resend API Key Leaked: Rotation and Damage ControlWhat an exposed re_ key allows, how to revoke it, and how to move email sending to a server route with domain restrictions.Resend · Next.js · Bolt
- Supabase PostgREST Schema Exposure: What It MeansWhy your table list is visible via /rest/v1/ with the anon key, what attackers learn from it, and how to reduce exposure.Supabase
- Rate Limiting AI Endpoints in Vibe-Coded AppsProtect LLM-backed routes from abuse with per-user limits, input caps and spend alerts, using Upstash Redis or your database.Next.js · Supabase · Replit