Guides
New guides
Ordered by the day each guide was published. A guide keeps a New badge for seven days from that date.
- Bolt apps, secrets, and Supabase access
Vite documents that VITE_ values are bundled into the client, and Vercel's Bolt export guide says the Secrets panel values are not in the zip you deploy.
- How to deploy your vibe-coded app securely
Put server secrets in the host's environment, keep them out of the browser bundle, and do not give a preview deploy the production database or a public URL it does not need.
- Keys committed to GitHub
A key in a commit is copied to every clone and to GitHub's history. Deleting the file in a new commit does not remove it.
- Lovable apps, RLS, keys, and auth
Lovable's own Supabase guide says missing row level security policies are the most common way app data gets exposed, and that secret keys must stay out of the client.
- Missing privacy policy and terms
If you collect accounts, emails, or payments, you need a page that says what you collect and a page that says the rules of the product.
- Outdated dependencies
A lockfile full of old packages is a pile of known bugs you have not looked at. Some are security fixes and some are noise, so you still have to look.
- Replit secrets and who can read them
Replit's secrets doc says hard-coded credentials leak through a public project, git, or a screen share, and that some collaborators can print secret values even when the UI hides them.
- Run Cloudflare's security-audit skill
Cloudflare's security-audit skill is a free MIT skill that drives a coding agent through a source audit. A full run spends agent invocations, and the skill file tells the agent to stop when the budget cannot cover them.
- v0 apps, public env vars, and Supabase auth
v0 deploys to Vercel and can connect a backend. Vercel and Supabase document which keys are public and which keys bypass row level security.
- Auth checked only in the UI
Hiding a button or a page does not stop a request. The server, the database policy, or both have to reject it.
- CORS wide open
Reflecting any website's Origin and allowing credentials means that website can call your API as the logged-in user.
- Cross-site scripting (XSS)
User content rendered as HTML runs in your origin. It can read that user's data and call your API as them.
- Exposed .env files and debug endpoints
A public .env, a /api/debug route, or a client bundle that prints config hands your secrets to anyone who asks.
- Firebase rules left open
Firestore or Storage rules that allow any read and write make the database public. The client SDK will do whatever the rules allow.
- IDOR: reading or changing someone else's data
The request carries an id, and the server fetches that id without checking that it belongs to the signed-in user.
- Missing security headers
Headers tell the browser not to sniff content, not to load you in a frame, and which scripts are allowed. They limit damage, and they do not replace auth.
- No cap on LLM API spend
A model route with your key and no limit is a meter anyone can run. One script can spend a month of budget in an afternoon.
- No rate limiting on auth or paid API routes
Login, password reset, and any route that calls a paid API will accept as many requests as an attacker sends, until the bill or the user list gives out.
- Open storage buckets
A public bucket, or a storage policy of allow-all, lets anyone with the URL read files other users uploaded.
- Prompt injection in LLM features
Text you feed a model, including user messages and documents it reads, can contain instructions. If the model can call tools, those instructions can become actions.
- Secret keys shipped in the frontend
A Supabase secret key, Stripe secret key, or model API key in the browser bundle is public. Anyone can copy it and use it as your server.
- Server Actions with no auth check
A Server Action is a public POST. 'use server' does not mean only your button can call it.
- SQL injection
User input glued into a SQL string can change the query. The database then runs the attacker's statement with your connection's privileges.
- Supabase tables without row level security
Tables in the public schema are reachable through the Supabase API. With row level security off, the publishable key is enough to read and change every row.
- The client sets the price, role, or plan
If the browser can send amount, plan, or role and the server saves it, users will send the values they want.
- Unsafe file uploads
An upload that trusts the browser's file type, keeps the original name, or serves the file from your site can become stored XSS or a malware host.
- Unverified Stripe webhooks
A webhook is a public URL. If you trust the JSON without checking Stripe's signature, anyone can tell your app that a payment succeeded.
- Weak password reset
A reset flow that uses a short code, a guessable link, or a client-only check lets someone take the account without the password.