Guides, answers & tools

Build with AI

For people who build software by talking to AI — how the machine thinks, what's really running your app, and how not to get burned · page 6

Build

The half of your app you can't see — and why every security rule has to live there

Frontend, server, database, API, secrets: the parts behind the glass, drawn as the journey of one tap, and why the safety checks can only work on the far side of it. Tap to follow it.

Aliteq Team · Updated Sep 26, 2026 · 6 min

Flat illustration of a person dropping a key into a locked drawer under a desk, with a dotted line to a small server

Build

The one file you must never commit — and the trap that ships secrets to the browser

Your app's keys live in labelled envelopes outside the code. Which envelopes the browser gets a copy of (VITE_, NEXT_PUBLIC_), where secret keys actually belong, and the .env file you keep out of git.

Aliteq Team · Updated Oct 27, 2026 · 6 min

Flat illustration of a browser window with a hidden compartment showing a key, while a person moves a key into a safe

BuildInteractive

Your API keys are in the browser: which ones matter and the fix

Whatever your app sends to the browser, anyone can read. Which keys are designed to be public, which must never be, how secrets end up there, and the server-function fix, from each vendor's own docs.

Aliteq Team · Updated Sep 27, 2026 · 7 min

BuildInteractive

Is your Lovable app showing everyone's data? How to check, and turn on RLS to stop it

If a Supabase table has Row Level Security off, anyone with your app's public key can read and write every row. How to check every table in two minutes, the SQL that turns RLS on and keeps it working, and the gotchas Supabase changed this year. Checked on Supabase's and Lovable's own docs, Nov 3, 2026.

Aliteq Team · Updated Nov 3, 2026 · 9 min

Flat illustration of an open database cylinder with envelopes and keys floating out while a person fits a padlock

Build

The Moltbook breach: what a public Supabase key without RLS grants

An AI-built social network left its whole database readable and writable. The key wasn't stolen; one setting was missing. What happened, from Wiz's write-up, and the lesson for anyone building on Supabase.

Aliteq Team · Sep 25, 2026 · 7 min

Flat illustration of a person with a clipboard checking padlock and shield icons around a laptop

Build

Before you share your vibe-coded app: the 6 security checks

The six mistakes behind 2026's vibe-coded app exposures, turned into checks you can do without reading code: RLS, secrets, server-side auth, admin, webhooks and rate limits.

Aliteq Team · Updated Oct 3, 2026 · 8 min