Guides

Plain-language answers on securing apps built with AI. Every guide ends with a free scan of your own site.

• Are my API keys safe in the browser? — Some keys belong in the browser and some never should. Here is how to tell which is which and how to check if a secret leaked into your app.
• Are AI-built apps secure? — AI-built apps can be secure, but not by default. Here is why the security configuration is left to you and how to close the common gaps.
• Exposed .env file: what it means — A public .env file hands over your secrets. Here is how it happens in AI-built apps and how to close it.
• How to fix missing security headers — Missing security headers let your site be framed, sniffed, or called by any origin. Here is what each header does and how to add them.
• Scan your website for free — Scan your website for security holes for free. What a free scan checks, what to look for, and where a scan's limits are.
• How to check if your website is secure — A quick, non-technical way to check if your website is secure: what to look at, and how to confirm each from your live URL.
• How to secure a Supabase database — A step-by-step way to secure a Supabase database: enable RLS, write scoped policies, keep the service-role key server-side, and verify from outside.
• Is my Base44 app secure? — Base44 ships full-stack apps fast. The security work sits in the backend and the keys. Here is what to check on a Base44 app.
• Is my Bolt.new app secure? — Bolt.new ships fast, and fast is where security gaps hide. Here are the exposures Bolt apps commonly have and how to check your own in a minute.
• Is my Bubble app secure? — Bubble handles a lot for you, but privacy rules and exposed data are still yours to get right. Here is what to check on a Bubble app.
• Is an app built with Cursor secure? — Cursor writes production code fast, so security review moves to you. Here are the common exposures in AI-written apps and how to check yours.
• Is my Lovable app secure? — Lovable apps are safe to build with, but the defaults can leave your database readable and your keys exposed. Here is what to check and how.
• Is my vibe-coded app safe? — A vibe-coded app is only as safe as the database rules and keys the AI left to you. Here is how to know for sure, from your public URL.
• How do I know if my website is hackable? — The signs a website is hackable, how attackers find them automatically, and how to check your own site from the outside in a minute.
• Is my Replit app secure? — Replit apps go from idea to live URL fast. Here are the exposures that ride along and how to check your deployed app.
• Is Supabase secure? — Supabase is secure when configured right, and dangerous when row-level security is off. Here is what makes a Supabase app safe or exposed.
• Is my v0 app secure? — v0 builds polished frontends fast. The security work sits in the backend it connects to. Here is what to check on a v0 app.
• Is an app built with Windsurf secure? — Windsurf writes production code fast, so the security review moves to you. Here are the exposures to check on a Windsurf-built app.
• No-code app security — No-code tools handle the infrastructure, but access rules and exposed data are still yours. Here is what to secure in a no-code app.
• How to scan your website for vulnerabilities — A plain-language walkthrough: how to scan your live site for vulnerabilities, what a scan finds, and what it cannot confirm.
• Security checklist for AI-built apps — A plain-language checklist to secure an app built with Lovable, Bolt, Cursor, v0, or Replit before you send real users to it.
• How to secure a SaaS before launch — A pre-launch security checklist for a SaaS built fast: lock the database, hide the secrets, set the headers, and verify from the outside.
• How to secure your vibe-coded site — Vibe-coded sites ship fast and skip security by default. Here are the five checks that close the holes AI builders leave, in plain language.
• 5 security mistakes that cost $100,000 — Five faults that ship in AI-built apps every day. Each one is invisible from the outside. Each one takes minutes to fix. Here is what they cost when nobody checks.
• The security scanner for indie hackers — Indie hackers ship fast and rarely have a security team. Here is how a passive scanner covers the basics before launch, cheaply.
• Your Supabase service-role key leaked. Now what? — The service-role key bypasses every rule you set. If it leaked, here is exactly what to do, in order.
• Is the Supabase anon key safe to expose? Yes, with one condition — The Supabase anon key is designed to be public and shipping it in your JavaScript is expected. It is only safe if row-level security is on. Here is how to tell.
• How to check if your Supabase database is exposed — If Supabase row-level security is off, anyone can read your tables from the browser. Here is how to check and how to fix it.
• Supabase RLS not enabled: what it means — Row-level security off means your tables are public. Here is exactly what that exposes and the steps to close it.
• The security risks of vibe coding — The real security risks of vibe coding: open databases, keys in the browser, public .env files. What they are, why they happen, and how to catch them.
• How to do a security audit on your website — A plain-language website security audit you can run yourself: what to check, in what order, and how to confirm each item from your live URL.
• A security scanner for your website — What a website security scanner checks, how passive scanning works, and how to scan an AI-built or vibe-coded site with no setup.
• What a security scanner cannot detect from outside your app — Every external security scanner has blind spots. Here are ours, named: 14 checks we cannot perform, 3 we infer rather than test, and 16 that need your permission.