Security guides for AI-built apps
Short, practical guides for people shipping apps with Lovable, Bolt, v0, Replit or Cursor. Each one tells you how to check the problem yourself, how to fix it, and what the free scan does and doesn't cover.
Start here
- Did my app leak its API key?
If a secret key ships in your frontend, anyone who opens your site can copy it. This page shows you how to check your live app the way an attacker would, and what to do if you find one.
- Lovable security checklist: 10 checks before you launch
Lovable gets you to a working app fast, and the security gaps it leaves are predictable. Work through these ten checks before you share the link, and again after any big change.
- Supabase RLS checklist: audit your tables in plain English
Most Supabase data leaks come from two mistakes: a table without Row Level Security, or a service_role key in the browser. This checklist walks you through finding both and fixing them with SQL you can paste.
- Vibe coding security: the 6 mistakes that get AI-built apps hacked
AI tools write working code, not safe defaults. The same six mistakes show up again and again in apps built with Lovable, Bolt, v0, Replit and Cursor, and every one of them can be checked from outside in minutes.
Fix a leaked key
- OpenAI API key exposed in your frontend? Revoke, move, and check
An OpenAI key in your browser code is a prepaid card taped to your front door: anyone can copy it and bill requests to you. This page walks through killing the key, finding where it shipped, and moving the calls somewhere safe.
- Stripe secret key exposed? Roll it now, then fix the code
A Stripe live secret key gives full API access to your account: charges, refunds, customer data. If one shipped in your frontend, this page tells you what to do in the next ten minutes and how to restructure the code so it can't happen again.
- VITE_ variables are public: what belongs in them (and what doesn't)
Every variable with a VITE_ prefix is pasted into your JavaScript when you build, so any visitor can read it. This page shows you how to prove that on your own app, which values are fine to ship, and where the secret ones go.
- Lovable app leaking an API key? Move it to an edge function
Lovable builds a Vite + React frontend, so any key the frontend reads ends up in public JavaScript. This page fixes one problem end to end: get a leaked key out of your Lovable app and into a server-side secret.
- Bolt.new app exposing keys? Where secrets should live
Bolt.new usually generates a Vite frontend, and a Vite frontend can't keep a secret. This page shows how to check the bundle you actually deployed and where each kind of key belongs on the hosts Bolt apps typically use.
Keep secrets out of your code and deploys
- NEXT_PUBLIC_ means public: securing keys in v0 and Next.js apps
Any environment variable that starts with NEXT_PUBLIC_ is written into the JavaScript your visitors download. v0 generates Next.js apps, so the same rule applies to every app it builds. This page shows how to prove it, and how to move a secret behind a server route without breaking the feature.
- Leaked an API key? The rotate-first playbook (OpenAI, Stripe, Supabase, AWS, Google)
You found a key where it shouldn't be: in your JavaScript, a public repo, a screenshot. Every minute it stays valid is a minute someone else can use it. This is the order to work in, with where each provider's revoke button lives.
- Replit Secrets aren't safe if your frontend reads them
Replit's Secrets tool encrypts your keys and hands them to your app as environment variables. That protects the key in your project, not in your published site. If client code reads the secret, Replit will happily ship it to every visitor.
- Is your .git folder public? Check /.git/HEAD and block it
If your web server hands out files from a folder that still contains .git, anyone can download your repository: every file and every old commit, including secrets you deleted months ago. This page is a .git-only deep dive: how the attack works, how to test it, and how to block it on common hosts.
- Cursor put your API key in the code? Find it, move it, stop it recurring
Ask an AI editor to "just make the API call work" and it may paste your key straight into a source file. Once that file is committed or deployed, the key is out. This page covers finding every copy, moving it, and stopping the agent from doing it again.
Headers, payments and Supabase settings
- A working Content-Security-Policy for Vite + Supabase + Stripe apps
Most AI-built React apps ship with no Content-Security-Policy at all, because the first strict policy you try breaks Supabase or Stripe. This page gives you a starter policy that already allows both, a way to test it without breaking production, and the file to put it in on Netlify, Vercel or Cloudflare Pages.
- Add security headers on Netlify, Vercel, and Cloudflare Pages (copy-paste)
Static hosts send almost none of the browser security headers by default; you add them with one small config file. Here are working blocks for each host, what every header does, and how to confirm they're live.
- Is your Stripe webhook verifying signatures? (AI builders often skip it)
If your webhook grants access when it receives checkout.session.completed, anyone who finds the URL can send that event themselves unless the handler checks Stripe's signature. Here's how to test yours and the few lines that fix it.
- Is the Supabase anon key safe in the frontend? Yes, if RLS is on
Builders find the Supabase anon key in their JavaScript and panic, or see a scanner flag it and assume they've been breached. The key itself is meant to be public. What it can reach depends entirely on your Row Level Security, and that is what you need to test.
- Supabase Storage: public buckets, signed URLs, and policies that actually protect files
Table RLS gets all the attention, but uploaded files live in Storage and follow their own rules. A bucket flipped to public to make images load can quietly publish invoices and ID scans. This page shows what public really means and how to lock files to their owner.
- The 15-minute pre-launch security pass for an AI-built app
It's launch day and you don't have time for an audit. This is a timed runbook, not another checklist: what to do in each block of minutes, what to skip if a block runs over, and what to leave for next week.
Compare security scanners
- ShipWatch vs LeakPatrol: What Each Scanner Checks
LeakPatrol and ShipWatch both read your live app from the outside and hand you fix prompts. They overlap a lot, and they differ in a few places that matter. This page lays the checks side by side, taken from each product's own public page, so you can pick on facts.
- ShipWatch vs Lockpick: Live-Site Scanners for Vibe-Coded Apps
Lockpick and ShipWatch both look at your live site from the outside and give you a prompt to fix what they find. Lockpick covers more ground: repos, MCP servers, DNS and email records. ShipWatch does one thing, the live site. Here's the honest side-by-side.
- Security Scanners for Vibe-Coded Apps, Compared (October 2026)
A year ago there was almost nothing built for apps made with Lovable, Bolt, v0 or Cursor. Now there are several, and their homepages all sound alike. This is a dated table of seven, built only from each vendor's own site, including where ShipWatch does less.