Security guides for AI-built apps

New: the free Supabase RLS policy checker reads your policies and grants (in your browser) and flags write holes an outside scan can't test.

Practical checks and fixes for apps built with Lovable, Bolt, v0, Cursor and Supabase, written by Pritesh Ghodge, a security engineer.

• Free tool: Supabase RLS policy checker
  Run one read-only SQL query, paste the result, and see every open INSERT, UPDATE, SELECT or DELETE policy and risky grant, with fix SQL. Runs in your browser; nothing is uploaded.
• Lovable app security checklist (from a security engineer)
  Nine checks before you share a Lovable app: built-in scans, RLS, views and grants, buckets, keys, edge functions, exposed files, headers and the two-account test.
• How to check if your Supabase tables are readable by anyone
  A 60-second curl test, the using (true) trap, and the SQL to fix it.
• Is your Supabase storage bucket public? How to check it and lock it down
  Find public buckets and storage policies that let strangers list or upload files, when public is fine, and how to move to private buckets, per-user folders and signed URLs.
• OpenAI, Claude or Gemini API key exposed in your frontend? What to do now
  How to check your live JavaScript for an AI key, the order to fix it in (new key, server route with auth and rate limits, revoke, spend cap), and a prompt for your AI builder.
• Supabase "42501 permission denied for table": fix it with a GRANT, not by turning off RLS
  What Supabase's 30 October 2026 grants change means, the safe per-role fix, the two fixes that open your data, and a prompt for your AI builder.
• Supabase service_role key exposed? Do this in the next 15 minutes
  Replace the key without breaking your app, check for misuse, and move privileged code to the server.
• 3 files your production site shouldn't be serving: .env, .git and source maps
  How each one ends up deployed, a curl test for each, how to block them, and what to rotate if one was public.
• Security headers for Lovable, Bolt, v0 and Cursor apps: CSP, HSTS and clickjacking
  Check what your live site sends with one curl command, which headers matter, and how to add them on Vercel, Netlify, Next.js or Lovable hosting.
• NEXT_PUBLIC_ and VITE_ variables are shipped to every visitor
  Which keys are safe in the browser, how to search your live bundle for leaks, and how to fix one.

Want this checked for you? Abbi Labs scans your live app for these issues; the first scan is free.