Guides
Security guides for apps built with AI
Short, practical answers for founders shipping with Lovable, Bolt, v0 and Cursor. Each guide starts with the answer, then shows the fix.
Is it safe to expose the Supabase anon key?
Yes: the Supabase anon (publishable) key is meant to be public. Your data is protected by row level security, not by hiding the key. Here is what that means.
How to enable RLS in a Lovable (Supabase) app
Step by step: turn on row level security for your Lovable or Bolt app's Supabase tables, write owner policies, and test them as a logged-out user.
Securing Supabase Edge Functions: verify_jwt is not enough
verify_jwt accepts the public anon key, so anyone can call your Supabase Edge Functions. How to check the user, protect cron jobs and verify webhooks.
How to stop a surprise OpenAI or Anthropic bill in your AI-built app
Keep AI keys on the server, require login, rate limit per user, cap tokens and set provider spending limits. A checklist for Lovable, Bolt and v0 apps.
Verifying Stripe webhooks in Lovable, Bolt and Supabase Edge Functions
Never grant paid access without verifying the Stripe signature. Code for Supabase Edge Functions (Deno) and Next.js, plus common mistakes in AI-built apps.
Lovable app security checklist before launch
A practical pre-launch security checklist for apps built with Lovable, Bolt or v0: Supabase RLS, keys, Edge Functions, payments, AI costs and launch basics.
How to check if your AI-built app is secure
Five checks you can run yourself in under an hour on an app built with Lovable, Bolt, Cursor or Claude Code, and what each one tells you.
Are your API keys exposed? VITE_, NEXT_PUBLIC_ and the front end
Any variable starting with VITE_ or NEXT_PUBLIC_ is copied into your public JavaScript. Which keys are safe there, which are not, and what to do if one leaked.
Bolt.new app security checklist
What to check before launching an app built with Bolt.new: keys in Vite variables, Supabase row level security, server functions, payments and AI costs.
Firebase security rules for apps built with AI
How to tell if your Firestore, Realtime Database or Storage rules let anyone read your data, why test mode rules are dangerous, and owner-only rules to copy.
Prompt injection: can users trick the AI feature in your app?
What prompt injection means for a small app with a chatbot or AI feature, what an attacker can actually do, and five fixes that work.
Security scanners for AI-built apps compared (2026)
Built-in scans, automated scanners and human audits for apps built with Lovable, Bolt, Cursor and Claude Code: what each one sees, what it costs, and when to use it.
Research
What we found in 24 public apps built with AI
How often open Edge Functions, readable tables and vulnerable packages show up in real Lovable and Bolt projects.