Guides
Security guides for vibe-coded apps
Plain-English steps you can run on your own app. No security degree needed. Not sure where to start? Take the free quiz and we'll point you to the right guide.
Is your Lovable or Bolt app leaking API keys?
How to search your own frontend bundle for secret keys, tell safe keys from dangerous ones, and fix a leak.
Read the guide →Supabase RLS checklist for vibe-coded apps
Ten checks for row level security: ownership policies, app_metadata vs user_metadata, security definer functions, security_invoker views and anon key tests.
Read the guide →Security checklist before launching a Cursor or AI-built app
Secrets, auth, authorization, payments, rate limits, headers and dependencies: what to check before your AI-built app goes live.
Read the guide →Protecting AI features from abuse and surprise bills
Server-side calls, per-user rate limits, token caps and provider spend limits, so a stranger can't run up your OpenAI or Anthropic bill.
Read the guide →Prompt injection basics for AI agent apps
Direct and indirect injection, the lethal trifecta, least-privilege tools, and safe canary tests you can run on your own agent.
Read the guide →Securing a vibe-coded multiplayer browser game
Leaderboards, server-authoritative multiplayer, realtime channels and leftover admin endpoints: how to keep players from cheating everyone else.
Read the guide →