Security guides
Short guides to the mistakes we find most often in apps built with Cursor, Claude Code, Lovable, Bolt and Replit. Most of them end with a fix prompt you can paste.
Start here
The broad checks. Read these first if you're about to launch.
Supabase
Row Level Security, policies and roles. Most data leaks in AI-built apps happen here.
- 03
Supabase RLS mistakes that leak your data
Four Row Level Security mistakes that leave Supabase tables open, with SQL you can paste to fix each one.
- 04
Supabase delete policies: 'authenticated' isn't enough
Why auth.role() = 'authenticated' lets every account delete every row, and the ownership check that fixes it.
- 05
Supabase insert policies: users can post as someone else
A login-only with check lets any user create rows in another user's name or join any team.
- 06
Supabase security definer views and RPCs skip RLS
Views without security_invoker and security definer functions return rows your policies hide.
- 07
Supabase storage policies: users can read each other's files
A policy that only checks bucket_id hands out every file. Folder checks, public buckets and signed URLs.
- 08
Supabase user_metadata: anyone can make themselves admin
Users can edit their own user_metadata, so roles and plans stored there can be self-assigned.
Next.js and auth
Server actions, API routes and login limits.
- 09
Next.js server actions security: every action is public
Every 'use server' function can be called with a direct POST. Add a login and ownership check inside each action.
- 10
Login rate limiting for your auth routes
Unlimited login and reset attempts let scripts guess passwords and spam your email bill. Limits for Next.js, Express and FastAPI.
Payments
Webhooks and paid plans that can be unlocked for free.
Secrets and dependencies
Keys in code, keys in the browser, and packages your AI made up.
- 12
Leaked API keys in vibe-coded apps
How keys end up in public repos and git history, and what to do once one has leaked.
- 13
NEXT_PUBLIC_ and VITE_ variables are public
Anything with these prefixes ships to every visitor, so here's which keys can live there and which can't.
- 14
Slopsquatting explained
AI tools sometimes invent package names, and attackers can register them before you run npm install.
Platforms
What to check on apps built with a specific AI tool.
Comparisons
Which kind of check finds what. Honest, with sources.