Practical checklists and copy-paste fix prompts for Lovable, Bolt, Replit, Cursor, v0, Supabase, and Firebase. Written for builders who shipped before they secured.
A practical checklist for Lovable apps on Supabase: leaked keys, RLS, .env exposure, and what a free passive scan can catch.
How to enable Supabase Row Level Security (RLS)Step-by-step: turn on RLS, write auth.uid() policies, and verify strangers cannot read your tables.
Exposed Supabase service_role key: what to do nowIf your service_role JWT is in the browser bundle, treat the database as compromised. Rotation and cleanup steps.
Lovable security checklistPre-launch security checklist for apps built with Lovable: secrets, auth, database rules, and headers.
Bolt.new security checklistPre-launch security checklist for apps built with Bolt.new: secrets, auth, database rules, and headers.
Replit security checklistPre-launch security checklist for apps built with Replit: secrets, auth, database rules, and headers.
Cursor security checklistPre-launch security checklist for apps built with Cursor: secrets, auth, database rules, and headers.
v0 security checklistPre-launch security checklist for apps built with v0: secrets, auth, database rules, and headers.
Firebase rules open to the public: how to tell and how to fixSpot open Realtime Database, Firestore, and Storage rules, and lock them down with auth-based rules.
How to check if your .env is exposedOne URL check that tells you if your production host is serving your secrets file — and how to fix it.
How to hide API keys when an AI builder writes your appPatterns that keep OpenAI, Stripe, and other secrets out of the browser when you vibe-code.
CVE-2025-48757 explained (Lovable + Supabase RLS)What the critical Lovable/Supabase RLS CVE was about, what the researcher found, and what to do on your app today.
Supabase anon key explained: public by design, safe only with RLSWhy seeing your anon key in the browser is normal — and when it becomes a breach.
Security headers for vibe-coded appsThe small set of HTTP headers worth setting on a Lovable, Bolt, or Replit deploy — and a prompt to add them.
Fix it and prove it: a security workflow for vibe codersScan, fix with AI prompts, re-scan, and only then ship — so the AI does not quietly undo your hardening.
Free passive scan — leaked keys, exposed .env/.git, Supabase/Firebase detection.