Security guides

Short guides to the mistakes we find most often in apps built with Cursor, Claude Code, Lovable, Bolt and Replit. Most of them end with a fix prompt you can paste.

• 01

  Vibe coding security checklist

  Ten checks to run on your AI-built app before strangers start using it.

• 02

  Your Stripe webhook can be faked

  How an unsigned webhook lets anyone fake a payment and unlock your paid plan, with the Next.js fix.

• 03

  Leaked API keys in vibe-coded apps

  How keys end up in public repos and git history, and what to do once one has leaked.

• 04

  Supabase RLS mistakes that leak your data

  Four Row Level Security mistakes that leave Supabase tables open, with SQL you can paste to fix each one.

• 05

  Your VITE_ and NEXT_PUBLIC_ variables are public

  Anything with these prefixes ships to every visitor, so here's which keys can live there and which can't.

• 06

  Is your Lovable app secure?

  What to check on a Lovable app before launch: RLS, anon keys, secrets and auth on the server.

• 07

  Slopsquatting explained

  AI tools sometimes invent package names, and attackers can register them before you run npm install.

• 08

  Is my AI-generated code secure?

  The five security problems we see most in AI-written code, plus a quick self-check.