Guides
Ship with AI, check like an engineer
Hands-on checks for sites built with AI tools: what usually goes wrong after launch, how to see it yourself in a few minutes, and the prompt that gets your AI to fix it.
Is my website secure? A plain-English check for non-developers
Not technical? Check your website's security yourself in about 15 minutes with a browser and a phone, and send your developer a ready-made list of questions.
· 8 min read · No tech skills needed
VITE_ env variables are visible in your build. What now?
Vite writes every VITE_ variable into the JavaScript your visitors download. How to see what your Lovable, Bolt or Vite app ships, and move secrets off the client.
· 7 min read
NEXT_PUBLIC_ env variable exposed a secret? How to check and fix
Next.js copies every NEXT_PUBLIC_ value into the JavaScript visitors download. How to find which secrets your live site ships and move them to the server.
· 7 min read
Lovable app security checklist before you launch
Eight checks to run on a Lovable app before you share the link — keys, Supabase tables, edge functions, headers, previews — with a prompt to fix what you find.
· 7 min read
OpenAI API key exposed in your frontend? What to do now
Your OpenAI key ended up in client-side code. Revoke it, check usage, move the call behind a server endpoint that can't be abused — step by step, with a prompt.
· 6 min read
Is the Supabase anon key safe to expose? Anon vs service_role
The anon or publishable key is meant to be public; the service_role or secret key must never reach the browser. How to tell which one your app ships, and fix it.
· 7 min read
How to find API keys leaked into your JavaScript bundle
Anyone can read your site's JavaScript. Here is how to search everything your live site loads for secret keys, tell public keys from secret ones, and fix a leak.
· 5 min read
How to check if Row Level Security is on in Supabase
A five-minute check that tells you whether strangers can read your Supabase tables with the public anon key — and the SQL and prompt to fix it.
· 5 min read
Why your Lovable site isn't showing up on Google
Your Lovable or Bolt site is live but invisible in search. Six checks that find the cause in ten minutes, and the fixes your AI can apply.
· 5 min read
Prefer a feed? RSS