Launch security guides
Plain-English fixes for the mistakes AI builders ship most often.
Is My Lovable App Secure? A Practical Check Before You Launch
How to tell if your Lovable app is safe to launch. Check Supabase RLS, exposed keys, auth on edge functions, and Stripe webhooks, with code you can copy.
Supabase RLS Checklist for Vibe Coders
A step-by-step Supabase Row Level Security checklist for AI-built apps. Find tables with RLS off, write safe policies, and avoid the common traps with views, storage and service_role.
Stripe Webhook Signature Verification in Next.js (App Router)
How to verify Stripe webhook signatures in a Next.js App Router route handler, why the raw body matters, and how to fulfill orders safely and idempotently.
Exposed API Keys in NEXT_PUBLIC_ (and VITE_) Env Vars
Why NEXT_PUBLIC_ and VITE_ environment variables are visible to everyone, which keys are safe to expose, how to find leaked ones, and how to move secrets server-side.
Pre-Launch Security Checklist for AI-Built Apps
A practical pre-launch security checklist for apps built with Lovable, Bolt, Cursor, Replit or v0. Secrets, database access, auth, payments, dependencies and monitoring.