Guides
Security, explained for the owner who cannot read the code.
Plain-English guides for owners of AI-built apps: Supabase row-level security, which keys are safe to expose, what to do after a leak, and a launch checklist.
All guides
- Is Lovable secure? What to check before your users doLovable itself is a reasonable platform, but apps built with it often ship with open Supabase tables and exposed keys. Here is what to check, in plain English.Read more
- How to turn on Supabase row-level security, in plain EnglishA plain-English guide to Supabase row-level security: what it does, how to turn it on, and the policies that let each user see only their own rows. With SQL.Read more
- Supabase anon key vs service role key: which one is safe to expose?The Supabase anon (publishable) key is meant to be public. The service role (secret) key must never reach the browser. How to tell them apart and fix a leak.Read more
- How to check whether your Supabase tables are publicTest your own Supabase project the way an attacker would: one request with the public anon key. If a row comes back, the table is public. Step by step.Read more
- The vibe coding security checklist: 12 checks before real users arriveA 12-point security checklist for apps built with Lovable, Bolt, Replit or v0. Keys, Supabase row-level security, storage, headers and packages, in plain English.Read more
- You leaked an API key. Here is what to do in the next hour.Found an API key in your GitHub repo or your app's JavaScript? Rotate it first, then clean up. A step-by-step plan for Supabase, Stripe and AI provider keys.Read more
Rather have it checked for you?
The Full Scan runs seven read-only checks and writes a fix prompt for every finding.