Blog
RSSLovable security: the most common issues
Lovable generates a real Supabase backend with real tables reachable the moment they exist. Misconfigured RLS and public previews: what comes up most.
Read the postSecuring your Bolt.new app before prod
Mis-prefixed VITE_ variables that ship a secret key into the public JS, missing security headers by default: the two most common pitfalls on a Bolt.new app.
Read the postv0: what the generator doesn't secure
A v0 component looks finished visually, but nothing guarantees RLS or CORS were ever thought through behind each form wired to a database.
Read the postCursor: the security mistakes that recur
Cursor doesn't generate an app in one shot, it edits an existing project prompt after prompt — a different risk: secrets pasted in the wrong file.
Read the postReplit Agent: securing before you share
Replit's secrets manager and a plain .env file coexist on the same platform — an agent taking the shortest path sometimes mixes them up.
Read the post2 critical RLS vulnerabilities — in our own app
While building Vetora on Supabase, we let through an RLS policy that let anyone unlock a paid report without paying. Here's what happened and how we fixed it.
Read the postExposed sk_live_ Stripe key in the JS
The most severe vulnerability we detect on AI-built apps: a Stripe secret key ending up in the JavaScript sent to the browser. How to spot and avoid it.
Read the postSupabase RLS: the anti-wiped-database guide
Row Level Security is the only line of defense between a visitor and your raw Supabase data. The most common traps and the pre-launch checklist.
Read the postPublicly accessible .env: the 10-second test
One curl request is enough to know whether your server secrets (API keys, passwords) are accessible to anyone. Why it happens, how to block it for good.
Read the postBolt, Lovable, v0, Cursor: on security
No ranking with made-up percentages — but a real difference in how each tool architects the backend, and where your risk concentrates depending on the tool.
Read the postSecurity checklist before delivering a site
Six things to check in 10 minutes before every delivery of an AI-generated site, to avoid the most frequent and costly-to-discover-later vulnerabilities.
Read the post