Security guides for vibe-coded apps

Short, practical answers to the security questions people ask after building an app with Lovable, Bolt, Cursor, v0 or Replit.

• Is my Lovable app secure? A 5-minute checkHow to check a Lovable, Bolt or v0 app for leaked API keys and an open Supabase database before you launch.
• How to check if Supabase RLS is enabled (and fix it)Find Supabase tables without row-level security, understand why the anon key exposes them, and turn RLS on with a safe policy.
• Firebase test mode rules: how to tell if your database is openCheck whether your Firestore or Realtime Database is still in test mode and readable by anyone, and replace the rules with safe ones.
• How to check if your website leaks API keysFind OpenAI, Stripe, AWS and other secret keys exposed in your frontend JavaScript, and what to do when you find one.
• OpenAI API key exposed in your frontend? Do this nowWhat happens when an OpenAI or Anthropic API key leaks in a vibe-coded app, how to rotate it, and how to call the API safely from a server.
• Security checklist for apps built with Bolt, Cursor, v0 and ReplitA short pre-launch security checklist for vibe-coded and AI-built apps: keys, databases, exposed files and headers.
• Is this Claude skill or MCP server safe to install? A 5-minute checkHow to check an AI agent skill (SKILL.md), plugin or MCP server for hidden commands, data leaks and stolen keys before you install it.