Guides
Checklists, not certificates
Short lists you can run before you share a URL. They will miss things. They are not a penetration test and they do not mean the app is safe.
- API keys leaking into the frontendHow to tell a publishable key from a secret, and how to check the JavaScript bundle of an AI-built app before you ship it.Updated 16 Oct 2026
- Pre-launch security checklist for vibe-coded appsA practical pass over secrets, database rules, auth, payments, and abuse before you share the URL of an app built with Lovable, Bolt, Cursor, or a similar tool.Updated 16 Oct 2026
- Rate limiting checklistWhere an AI-built app usually needs a limit, and what to verify so the limit is on the server rather than on a disabled button.Updated 16 Oct 2026
- Stripe webhook verification checklistWhat to confirm so a Stripe payment is recorded from Stripe’s signed event, not from a success page the browser can fake.Updated 16 Oct 2026
- Supabase row-level security checklistWhat to verify on Supabase before a Lovable, Bolt, or other client is allowed to talk to the database with the anon key.Updated 16 Oct 2026