Security guides for AI-built apps
The mistakes we see most, how to check for each one, and a prompt your AI can use to fix it.
Lovable app with Supabase: is your database open? (RLS check)Supabase service_role or secret key exposed in your frontendBolt app exposing your OpenAI or Stripe key? How to check and fixIs your .env file public? Checking a Cursor-built app for leaked secretsReplit apps: keep API keys in Secrets, not in your codev0 / Next.js apps: NEXT_PUBLIC_ variables are publicMissing security headers on your AI-built app (CSP, HSTS, X-Frame-Options)Open CORS: when Access-Control-Allow-Origin lets any site inExposed .git folder: anyone can download your source codePublic source maps: your original code is readable by anyone