Blog
RSSLovable security: the most common vulnerabilities (and how to fix them)
Lovable generates a real Supabase backend, with real tables that are reachable the moment they exist — not just an interface. Misconfigured RLS and a public preview link: what comes up most often, and how to fix it.
Read the postSecuring your Bolt.new app before it goes to production
Mis-prefixed VITE_ variables that ship a secret key into the public JS, security headers missing by default: the two most common pitfalls on a Bolt.new app, and how to avoid them.
Read the postv0: what the generator doesn't secure for you
A v0 component looks finished visually, but nothing guarantees RLS or CORS were ever thought through behind each form wired to a database. How to avoid the false sense of security.
Read the postCursor and AI pair programming: the security mistakes that keep coming back
Cursor doesn't generate an app in one shot, it edits an existing project prompt after prompt — a different risk: secrets pasted in the wrong file, or committed before .gitignore ever covers them.
Read the postReplit Agent: securing an app before you share it
Replit's secrets manager and a plain .env file coexist on the same platform — an agent taking the shortest path sometimes mixes them up. What to check before making a Repl public.
Read the postWe found 2 critical RLS vulnerabilities — in our own app
While building Vetora on Supabase, we let through exactly the kind of vulnerability we scan for on other sites: an RLS policy that let anyone unlock a paid report without paying. Here's what happened and how we fixed it.
Read the postExposed sk_live_ Stripe key in the JS: how it happens with Bolt, Lovable, or v0
The most severe vulnerability we detect, and one of the most common on AI-built apps: a Stripe secret key that ends up in the JavaScript sent to the browser. How it happens, how to spot it in 30 seconds, how to avoid it.
Read the postSupabase RLS: the guide to not getting your database wiped
Row Level Security is the only line of defense between any visitor and the raw content of your Supabase database. The three most common traps (missing policy, USING (true), unnecessary writes) and the checklist to run before going to production.
Read the postPublicly accessible .env: the 10-second test
One curl request is enough to know whether all your server secrets (API keys, database passwords) are accessible to anyone. Why it happens with a fast deployment, and how to block it for good.
Read the postBolt, Lovable, v0, Cursor: what actually changes on the security side
No ranking with made-up percentages — but a real difference in how each tool architects the backend by default, and therefore in where your risk concentrates depending on the tool you use.
Read the postSecurity checklist before delivering to a client (agencies & vibe-coding freelancers)
Six things to check in 10 minutes before every delivery of an AI-generated site — not a full audit, but enough to avoid the most frequent and most costly-to-discover-later vulnerabilities.
Read the post