Build with AI

For people who build software by talking to AI — how the machine thinks, what's really running your app, and how not to get burned · page 6

Flat illustration of a customer handing an order slip across a café counter and getting a tray back

BuildInteractive

Every tap sends a tiny message to a stranger's computer — this is what's inside

Method, headers, body, status code: what your phone actually sends, what comes back, and why the server has to check every word of it. Tap through a real one.

Aliteq Team · Sep 25 · 4 min

Flat illustration of a person looking up a name in a giant phone book, with a dotted line to a house on a hill

BuildInteractive

Your phone knows a name, not an address — DNS is how it finds the site

Type a domain and something has to turn that name into a number your phone can actually reach. The internet's phone book, and what it means when you connect a custom domain. Tap to follow it.

Aliteq Team · Sep 25 · 4 min

Flat illustration of a person holding an addressed envelope and pointing at one highlighted house on a map

BuildInteractive

The address bar is doing four jobs at once — here's each one

Every tap starts with a URL, and its four parts decide where your request goes and what it carries. Why nothing private should ever sit in one. Tap through the journey.

Aliteq Team · Sep 25 · 4 min

Build

The half of your app you can't see — and why every security rule has to live there

Frontend, server, database, API, secrets: the parts behind the glass, drawn as the journey of one tap, and why the safety checks can only work on the far side of it. Tap to follow it.

Aliteq Team · Sep 25 · 6 min

Flat illustration of a person dropping a key into a locked drawer under a desk, with a dotted line to a small server

Build

The one file you must never commit — and the trap that ships secrets to the browser

Your app's keys live in labelled envelopes outside the code. Which envelopes the browser gets a copy of (VITE_, NEXT_PUBLIC_), where secret keys actually belong, and the .env file you keep out of git.

Aliteq Team · Sep 25 · 6 min

Flat illustration of a browser window with a hidden compartment showing a key, while a person moves a key into a safe

BuildInteractive

Your API keys are in the browser: which ones matter and the fix

Whatever your app sends to the browser, anyone can read. Which keys are designed to be public, which must never be, how secrets end up there, and the server-function fix, from each vendor's own docs.

Aliteq Team · Sep 25 · 7 min

Flat illustration of two people each looking through their own window at a table, each seeing only their own coloured rows

BuildInteractive

Your Lovable app might be showing everyone's data — one setting fixes it

The single database setting behind the biggest vibe-coded app leaks, shown as a who-can-see-what table you can toggle: data wide open, then locked to its owner. The policy your AI tool should be writing.

Aliteq Team · Sep 25 · 7 min

Flat illustration of an open database cylinder with envelopes and keys floating out while a person fits a padlock

Build

The Moltbook breach: what a public Supabase key without RLS grants

An AI-built social network left its whole database readable and writable. The key wasn't stolen; one setting was missing. What happened, from Wiz's write-up, and the lesson for anyone building on Supabase.

Aliteq Team · Sep 25 · 7 min

Flat illustration of a person with a clipboard checking padlock and shield icons around a laptop

Build

Before you share your vibe-coded app: the 6 security checks

The six mistakes behind 2026's vibe-coded app exposures, turned into checks you can do without reading code: RLS, secrets, server-side auth, admin, webhooks and rate limits.

Aliteq Team · Sep 25 · 8 min